title: IAM Role limit sts:AssumeRole to one AWS Lambda function
body: <p>I am concerned about security. The creation of IAM Roles is a high security risk, and the fact that you can only specify to be AWS Lambda the one that can assume a role is not good enough IMO. There could be a privilege escalation if not treated with care.</p>
  
  <p>How can I create IAM Roles specific to some Lambda functions?</p>
  
  <p>I haven't found anything similar, but I believe it may be possible.</p>
  
  <p>This role would have also some policies attached:</p>
  
  <pre><code>{
    "Action": "sts:AssumeRole",
    "Principal": {
      "Service": "lambda.amazonaws.com"
    },
    "Effect": "Allow",
    "Sid": ""
  }
  </code></pre>
  
  <p>Usually, in other roles you would use Principal clause to decide which accounts can assume the role.</p>
  
  <pre><code>{
   "Effect": "Allow",
   "Principal": {
     "AWS": "arn:aws:iam::123456789:root"
   },
   "Action": "sts:AssumeRole"
  }
  </code></pre>
  
  <p>According to @Michael in the comments, I have to say which users can use pass role on which roles, therefore is the question, how can I decide which users exactly can pass this role?</p>
  
  <p>If so, the answer to this question would be solved in two steps. Making this role only assumable by Lambda service (as it is already), and then have a policy with PassRole restrictions for each user.</p>