Request Parameters Response Elements Errors Examples See Also

AssumeRoot

Returns a set of short term credentials you can use to perform privileged tasks on a member account in your organization.

Before you can launch a privileged session, you must have centralized root access in your organization. For steps to enable this feature, see Centralize root access for member accounts in the IAM User Guide.

Note

The Amazon STS global endpoint is not supported for AssumeRoot. You must send this request to a Regional Amazon STS endpoint. For more information, see Endpoints.

You can track AssumeRoot in Amazon CloudTrail logs to determine what actions were performed in a session. For more information, see Track privileged tasks in Amazon CloudTrail in the IAM User Guide.

Request Parameters

For information about the parameters that are common to all actions, see Common Parameters.

DurationSeconds

The duration, in seconds, of the privileged session. The value can range from 0 seconds up to the maximum session duration of 900 seconds (15 minutes). If you specify a value higher than this setting, the operation fails.

By default, the value is set to 900 seconds.

Type: Integer

Valid Range: Minimum value of 0. Maximum value of 900.

Required: No

TargetPrincipal

The member account principal ARN or account ID.

Type: String

Length Constraints: Minimum length of 12. Maximum length of 2048.

Required: Yes

TaskPolicyArn

The identity based policy that scopes the session to the privileged tasks that can be performed. You can use one of following Amazon managed policies to scope root session actions.

Type: PolicyDescriptorType object

Required: Yes

Response Elements

The following elements are returned by the service.

Credentials

The temporary security credentials, which include an access key ID, a secret access key, and a security token.

Note

The size of the security token that Amazon STS API operations return is not fixed. We strongly recommend that you make no assumptions about the maximum size.

Type: Credentials object

SourceIdentity

The source identity specified by the principal that is calling the AssumeRoot operation.

You can use the aws:SourceIdentity condition key to control access based on the value of source identity. For more information about using source identity, see Monitor and control actions taken with assumed roles in the IAM User Guide.

The regex used to validate this parameter is a string of characters consisting of upper- and lower-case alphanumeric characters with no spaces. You can also include underscores or any of the following characters: =,.@-

Type: String

Length Constraints: Minimum length of 2. Maximum length of 64.

Pattern: [\w+=,.@-]*

Errors

For information about the errors that are common to all actions, see Common Errors.

ExpiredToken

The web identity token that was passed is expired or is not valid. Get a new identity token from the identity provider and then retry the request.

HTTP Status Code: 400

RegionDisabled

Amazon STS is not activated in the requested region for the account that is being asked to generate credentials. The account administrator must use the IAM console to activate Amazon STS in that region. For more information, see Activating and Deactivating Amazon STS in an Amazon Region in the IAM User Guide.

HTTP Status Code: 403

Examples

Example

This example illustrates one usage of AssumeRoot.

Sample Request


https://sts.amazonaws.com/
?Version=2011-06-15
&Action=AssumeRoot
&DurationSeconds=900
&TargetPrincipal=111122223333
&TaskPolicyArn.arn=arn:aws:iam::aws:policy/root-task/IAMDeleteRootUserCredentials

Sample Response


<AssumeRootResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
  <AssumeRootResult>
  <SourceIdentity>Alice</SourceIdentity>
    <Credentials>
      <AccessKeyId>ASIAIOSFODNN7EXAMPLE</AccessKeyId>
      <SecretAccessKey>wJalrXUtnFEMI/K7MDENG/bPxRfiCYzEXAMPLEKEY</SecretAccessKey>
      <SessionToken>
       AQoDYXdzEPT//////////wEXAMPLEtc764bNrC9SAPBSM22wDOk4x4HIZ8j4FZTwdQW
       LWsKWHGBuFqwAeMicRXmxfpSPfIeoIYRqTflfKD8YUuwthAx7mSEI/qkPpKPi/kMcGd
       QrmGdeehM4IC1NtBmUpp2wUE8phUZampKsburEDy0KPkyQDYwT7WZ0wq5VSXDvp75YU
       9HFvlRd8Tx6q6fE8YQcHNVXAkiY9q6d+xo0rKwT38xVqr7ZD0u0iPPkUL64lIZbqBAz
       +scqKmlzm8FDrypNC9Yjc8fPOLn9FX9KSYvKTr4rvx3iSIlTJabIQwj2ICCR/oLxBA==
      </SessionToken>
      <Expiration>2019-11-09T13:34:41Z</Expiration>
    </Credentials>
  </AssumeRoleResult>
  <ResponseMetadata>
    <RequestId>c6104cbe-af31-11e0-8154-cbc7ccf896c7</RequestId>
  </ResponseMetadata>
</AssumeRootResponse>