AssumeRootCommand

Suggest an Edit

Returns a set of short term credentials you can use to perform privileged tasks on a member account in your organization.

Before you can launch a privileged session, you must have centralized root access in your organization. For steps to enable this feature, see Centralize root access for member accounts  in the IAM User Guide.

The STS global endpoint is not supported for AssumeRoot. You must send this request to a Regional STS endpoint. For more information, see Endpoints .

You can track AssumeRoot in CloudTrail logs to determine what actions were performed in a session. For more information, see Track privileged tasks in CloudTrail  in the IAM User Guide.

Example Syntax

Use a bare-bones client and the command you need to make an API call.

import { STSClient, AssumeRootCommand } from "@aws-sdk/client-sts"; // ES Modules import
// const { STSClient, AssumeRootCommand } = require("@aws-sdk/client-sts"); // CommonJS import
const client = new STSClient(config);
const input = { // AssumeRootRequest
  TargetPrincipal: "STRING_VALUE", // required
  TaskPolicyArn: { // PolicyDescriptorType
    arn: "STRING_VALUE",
  },
  DurationSeconds: Number("int"),
};
const command = new AssumeRootCommand(input);
const response = await client.send(command);
// { // AssumeRootResponse
//   Credentials: { // Credentials
//     AccessKeyId: "STRING_VALUE", // required
//     SecretAccessKey: "STRING_VALUE", // required
//     SessionToken: "STRING_VALUE", // required
//     Expiration: new Date("TIMESTAMP"), // required
//   },
//   SourceIdentity: "STRING_VALUE",
// };

Example Usage

 Loading code editor

AssumeRootCommand Input

See AssumeRootCommandInput for more details

Parameter
Type
Description
TargetPrincipal
Required
string | undefined

The member account principal ARN or account ID.

TaskPolicyArn
Required
PolicyDescriptorType | undefined

The identity based policy that scopes the session to the privileged tasks that can be performed. You can use one of following Amazon Web Services managed policies to scope root session actions.

DurationSeconds
number | undefined

The duration, in seconds, of the privileged session. The value can range from 0 seconds up to the maximum session duration of 900 seconds (15 minutes). If you specify a value higher than this setting, the operation fails.

By default, the value is set to 900 seconds.

AssumeRootCommand Output

See AssumeRootCommandOutput for details

Parameter
Type
Description
$metadata
Required
ResponseMetadata
Metadata pertaining to this request.
Credentials
Credentials | undefined

The temporary security credentials, which include an access key ID, a secret access key, and a security token.

The size of the security token that STS API operations return is not fixed. We strongly recommend that you make no assumptions about the maximum size.

SourceIdentity
string | undefined

The source identity specified by the principal that is calling the AssumeRoot operation.

You can use the aws:SourceIdentity condition key to control access based on the value of source identity. For more information about using source identity, see Monitor and control actions taken with assumed roles  in the IAM User Guide.

The regex used to validate this parameter is a string of characters consisting of upper- and lower-case alphanumeric characters with no spaces. You can also include underscores or any of the following characters: =,.-

Throws

Name
Fault
Details
ExpiredTokenException
client

The web identity token that was passed is expired or is not valid. Get a new identity token from the identity provider and then retry the request.

RegionDisabledException
client

STS is not activated in the requested region for the account that is being asked to generate credentials. The account administrator must use the IAM console to activate STS in that region. For more information, see Activating and Deactivating STS in an Amazon Web Services Region  in the IAM User Guide.

STSServiceException
Base exception class for all service exceptions from STS service.