All 7 AWS Organizations & Multi Account Strategy questions
More in AWS Organizations & Multi Account Strategy
Why do organizations commonly adopt a multi account strategy instead of running all workloads within a single AWS account? What are Organizational Units in AWS Organizations, and how do they help structure a large number of accounts logically? What are Service Control Policies, and how do they enforce security and compliance guardrails across an entire organization? What is the AWS Landing Zone or AWS Control Tower, and how does it help set up a well architected multi account environment quickly? How should an organization design its overall account structure and governance model to balance security isolation with developer agility and operational efficiency?
Advertisement
Back to results for “Sharing”
AWS › AWS Organizations & Multi Account Strategy

How can cross account IAM roles enable secure resource sharing and centralized management across accounts within an organization?

Advanced

Answer

Cross account IAM roles let a user or service in one account temporarily assume a role defined in another account, gaining exactly the permissions granted by that role without needing separate long lived credentials for every account, which is commonly used to allow a central security team to audit resources across all accounts, or to let a CI/CD pipeline running in a shared tooling account deploy resources into separate development and production accounts securely.
aws sts assume-role --role-arn arn:aws:iam::PRODUCTION_ACCOUNT_ID:role/CentralAuditRole --role-session-name audit-session
Real-world example A central security team uses cross account roles to assume read only audit permissions across every account in the organization from a single central account, without needing separate credentials or user accounts created individually in each of those fifty accounts.

Common follow-ups: How do you establish the trust relationship required for cross account role assumption?;What is the difference between cross account roles and resource based policies for sharing access?

IAM;AWS Cost Management & Billing
All 7 AWS Organizations & Multi Account Strategy questions