Glossary
STS AssumeRole
The AWS STS operations that exchange a trust relationship for temporary role credentials — AssumeRole, AssumeRoleWithSAML and AssumeRoleWithWebIdentity.
AWS Security Token Service (STS) issues temporary credentials (ASIA…
keys plus a session token) when a principal assumes an IAM role. The role's
trust policy decides who may assume it: users or roles in the same
account, other AWS accounts, AWS services, or federated identities through
AssumeRoleWithSAML and AssumeRoleWithWebIdentity.
In CloudTrail, the AssumeRole event shows the caller and the new
session's access key in responseElements; later calls by that session
appear as userIdentity.type = AssumedRole. Attackers abuse this by adding
their own account to a trust policy (UpdateAssumeRolePolicy) or a new
identity provider — see IAM persistence and privilege escalation.
Reference: AssumeRole API.