AWS › AWS Organizations & Multi Account Strategy

How can cross account IAM roles enable secure resource sharing and centralized management across accounts within an organization?

Advanced

Answer

Cross account IAM roles let a user or service in one account temporarily assume a role defined in another account, gaining exactly the permissions granted by that role without needing separate long lived credentials for every account, which is commonly used to allow a central security team to audit resources across all accounts, or to let a CI/CD pipeline running in a shared tooling account deploy resources into separate development and production accounts securely.

aws sts assume-role --role-arn arn:aws:iam::PRODUCTION_ACCOUNT_ID:role/CentralAuditRole --role-session-name audit-session

Real-world example A central security team uses cross account roles to assume read only audit permissions across every account in the organization from a single central account, without needing separate credentials or user accounts created individually in each of those fifty accounts.

Common follow-ups: How do you establish the trust relationship required for cross account role assumption?;What is the difference between cross account roles and resource based policies for sharing access?

IAM;AWS Cost Management & Billing