title: How to Assume Cross-Account Role?
body: <p>AWS' Golang SDK says that I should use <code>stscreds.AssumeRoleProvider</code> to assume a cross-account role (in this case, for querying another account's DynamoDb table from a web server). This code works:</p>
  
  <pre><code>var sess *session.Session
  
  func init() {
  
    sess = session.Must(session.NewSession(&amp;aws.Config{
      Region: aws.String("us-west-2"),
    }))
  
  }
  
  func getDynamoDbClient() *dynamodb.DynamoDB {
  
    crossAccountRoleArn := "arn:...:my-cross-account-role-ARN"
  
    creds := stscreds.NewCredentials(sess, crossAccountRoleArn, func(arp *stscreds.AssumeRoleProvider) {
      arp.RoleSessionName = "my-role-session-name"
      arp.Duration = 60 * time.Minute
      arp.ExpiryWindow = 30 * time.Second
    })
  
    dynamoDbClient := dynamodb.New(sess, aws.NewConfig().WithCredentials(creds))
  
    return dynamoDbClient
  }
  </code></pre>
  
  <p>According to the documentation, the returned client is thread-safe:</p>
  
  <blockquote>
    <p>DynamoDB methods are safe to use concurrently.</p>
  </blockquote>
  
  <p>The question is, since the credential are auto-renewed via <code>stscreds.AssumeRoleProvider</code>, do I</p>
  
  <ul>
  <li><p>Need to new up a new client on each request (to ensure that I've got unexpired credentials), or</p></li>
  <li><p>Can I new up a DynamoDb client when the web server starts up, and reuse it for the life of the web server?</p></li>
  </ul>
  
  <h1>Edited To Note:</h1>
  
  <p>I dug into the source code for the Golang AWS SDK, and it looks like the credentials returned by <code>stscreds.NewCredentials()</code> are nothing more than a wrapper around a reference to the <code>stscreds.AssumeRoleProvider</code>. So it seems likely to me that the client will magically get auto-renewed credentials.</p>
  
  <p>AWS' documentation leaves something to be desired.</p>