Cloud Architecture

Cross-Account IAM Roles for AWS

Cloud Architecture diagram · made in Skemio

Cross-account IAM role flow showing an engineer authenticating in an Identity account and assuming a production role via AWS STS tokens.
Cross-account IAM role flow showing an engineer authenticating in an Identity account and assuming a production role via AWS STS tokens.
Open it in SkemioMake your own

What it shows

  • Centralize identity in one account using SSO or IAM user directories.
  • Assume short-lived STS credentials in target accounts via IAM roles.
  • Enforce external IDs and MFA conditions to thwart confused deputy attacks.

The takeaway

Eliminate long-lived access keys by delegating cross-account role assumption with STS tokens.

More cloud architecture diagrams