How to assume an AWS role from another AWS role?

Question

I have two AWS account - lets say A and B.

In account B, I have a role defined that allow access to another role from account A. Lets call it Role-B

{   "Version": "2012-10-17",   "Statement": [   {      "Effect": "Allow",      "Principal": {          "AWS": "arn:aws:iam::********:role/RoleA"      },     "Action": "sts:AssumeRole"   }] } 

In account A, I have defined a role that allows the root user to assume role. Lets call it Role-A

{   "Version": "2012-10-17",   "Statement": [   {      "Effect": "Allow",      "Principal": {          "AWS": "arn:aws:iam::********:root"      },     "Action": "sts:AssumeRole"   }] } 

Role A has the following policy attached to it

 {     "Version": "2012-10-17",     "Statement": [         {             "Action": "sts:AssumeRole",             "Resource": "arn:aws:iam::****:role/RoleB",             "Effect": "Allow"        }]  } 

As a user in account A, I assumed the Role-A. Now using this temporary credential, I want to assume the Role-B and access the resource owned by account B. I have the below code

client = boto3.client('sts')  firewall_role_object = client.assume_role(     RoleArn=INTERMEDIARY_IAM_ROLE_ARN,     RoleSessionName=str("default"),     DurationSeconds=3600)  firewall_credentials = firewall_role_object['Credentials']  firewall_client = boto3.client(     'sts',     aws_access_key_id=firewall_credentials['AccessKeyId'],     aws_secret_access_key=firewall_credentials['SecretAccessKey'],     aws_session_token=firewall_credentials['SessionToken'], )  optimizely_role_object = firewall_client.assume_role(     RoleArn=CUSTOMER_IAM_ROLE_ARN,     RoleSessionName=str("default"),     DurationSeconds=3600)  print(optimizely_role_object['Credentials']) 

This code works for the set of roles I got from my client but is not working for the roles I defined between two of the AWS account I have access to.

Answer 1

Finally got this working. The above configuration is correct. There was a spelling mistake in the policy.

I will keep this question here for it may help someone who want to achieve double hop authentication using roles.