IAM Tutorial: Delegate access across AWS accounts using IAM roles

Step 1: Create a role

• You can allow users from one AWS account to access resources in another AWS account.

• Create a role that defines who can access it and what permissions it grants to users that switch to it.

Step 2: Grant access to the role

• Add the following policy statement:

{
  "Version": "2012-10-17",
  "Statement": {
    "Effect": "Allow",
    "Action": "sts:AssumeRole",
    "Resource": "arn:aws:iam::PRODUCTION-ACCOUNT-ID:role/UpdateApp"
  }
}

Step 3: Allow user to switch roles