How to Assume Role Across Accounts in AWS

If you need to assume role between AWS accounts, or allow an account to assume a role and use resources in another AWS account, then you need to create a role and attach the following policy.

The following two (2) steps creates a Trust Relationship between the accounts.

Step 1 – In the Source Account

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "sts:AssumeRole"
    ],
    "Resource": [
      "arn:aws:iam::DESTINATION-ACCOUNT-ID:role/DESTINATION-ROLENAME"
    ]
  }]
}

Step 2 – In the Destination Account

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {
      "AWS": "arn:aws:iam::SOURCE-ACCOUNT-ID:role/SOURCE-USERNAME"
    },
    "Action": "sts:AssumeRole"
  }]
}