title: How enable access to AWS STS AssumeRole
body: <p>I am getting an error when calling to <code>assume role</code> method of STS. It says that the user is not authorized to perform <code>sts:AsumeRole</code> on resource <code>xxx</code>.</p>
  
  <p>I did the following:</p>
  
  <ol>
  <li>I created a role to access to S3 bucket.</li>
  <li>I ran a test over policy simulator and works fine</li>
  <li>I created a new group, and in it, i created a new policy that
  enables all sts actions, over all resources.</li>
  <li>I ran a test with the policy simulator, to sts assume role, pointing
  to the ARN of role created at step one; and it works fine</li>
  <li>I created a new user, and put it in group created at step 3</li>
  <li>With the credentials of the new user, i try to get a new credentials
  using sts asume role, but throw me an error that say my user is not
  authorized to perform sts:AssumeRole</li>
  </ol>
  
  <p>What am I doing wrong?</p>
  
  <p>Policy in Group</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "some-large-id",
              "Effect": "Allow",
              "Action": [
                  "sts:*"
              ],
              "Resource": [
                  "*"
              ]
          }
      ]
  }
  </code></pre>
  
  <p>Policy in role</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "another-large-id",
              "Effect": "Allow",
              "Action": [
                  "s3:PutObject"
              ],
              "Resource": [
                  "arn:aws:s3:::my-bucket-name/*"
              ]
          }
      ]
  }
  </code></pre>
  
  <p>And finally calling like this</p>
  
  <pre><code>let policy = {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "new-custom-id",
              "Effect": "Allow",
              "Action": ["s3:PutObject"],
              "Resource": ["arn:aws:s3:::my-bucket-name/*"]
          }
      ]
  };
  
  let params = {
      DurationSeconds: 3600, 
      ExternalId: 'some-value', 
      Policy: JSON.stringify(policy), 
      RoleArn: "arn:aws:iam::NUMBER:role/ROLE-NAME", //Cheked, role is the same that step one
      RoleSessionName: this.makeNewSessionId()
  };
  let sts = new AWS.STS({ apiVersion: '2012-08-10' });
  
  sts.assumeRole(params, (err, data) =&gt; {
      if(err) console.log(err);
      else console.log(data);
  });
  </code></pre>