Assume a role
Chain AssumeRole from any AWS session.
An assume-role session calls STS AssumeRole with the credentials of another session as its source. The source can be an Identity Center role, an IAM user, or another assumed role.
rolle session add assume-role \
--name prod-admin \
--role-arn arn:aws:iam::123456789012:role/Admin \
--source "Acme Prod/AdministratorAccess" \
--region us-east-1
rolle start prod-admin| Flag | Meaning |
|---|---|
--name |
Session name |
--role-arn |
Role to assume |
--source |
Session that provides the source credentials |
--region |
Default region |
--external-id |
External ID when the trust policy requires one |
--profile |
AWS profile name. Empty uses default |
Duration
The requested duration comes from Settings → General → Assume role duration (60 minutes by default). When the source is itself a temporary session, AWS caps the chained duration at one hour, and rolle requests one hour.
Start the source session first. An assume-role session does not start its source, and both stay active while the role runs. The role and its source cannot write the same AWS profile: give one of them another profile before you start the role.