title: Assume AWS Role From User in Same Account
body: <p>I'm a little confused about the requirements for assuming a role <strong>from an IAM user</strong> in <strong>the same AWS account</strong>.</p>
  
  <p>Per this document: <a href="https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html</a>:</p>
  
  <blockquote>
    <p>If the user is in the same account as the role, then you can do either
    of the following:</p>
    
    <ul>
    <li><p>Attach a policy to the user (identical to the previous user in a
    different account).</p></li>
    <li><p>Add the user as a principal directly in the role's trust policy.</p></li>
    </ul>
  </blockquote>
  
  <p>I explicitly added an assume-role policy to the group granted to my user and it could not assume the noted role:</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "arn:aws:iam::123456789:role/some-role-name"
    }
  }
  </code></pre>
  
  <p>Once I added the account number as a principal to the trust policy of the target role, it started working though:</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {
          "Service": "ec2.amazonaws.com",
          "AWS": "arn:aws:iam::123456789:root"
        },
        "Action": "sts:AssumeRole"
      }
    ]
  }
  </code></pre>
  
  <p>So, I'm confused for 2 reasons:</p>
  
  <ol>
  <li>Why didn't the first policy alone work given the documentation I've quoted?</li>
  <li>The second bullet in the documentation says "add the user as a principal".  I think I added the whole account though instead of the user.  What is the syntax for adding just this user?  I didn't come across it in the documents I read.</li>
  </ol>