assume_root¶
Operation¶
async
¶
assume_root(input: AssumeRootInput, plugins: list[Plugin] | None = None) -> AssumeRootOutput
Returns a set of short term credentials you can use to perform
privileged tasks on a member account in your organization. You must use
credentials from an Organizations management account or a delegated
administrator account for IAM to call AssumeRoot. You cannot use root
user credentials to make this call.
Before you can launch a privileged session, you must have centralized root access in your organization. For steps to enable this feature, see Centralize root access for member accounts in the IAM User Guide.
Note
The STS global endpoint is not supported for AssumeRoot. You must send this request to a Regional STS endpoint. For more information, see Endpoints.
You can track AssumeRoot in CloudTrail logs to determine what actions were performed in a session. For more information, see Track privileged tasks in CloudTrail in the IAM User Guide.
When granting access to privileged tasks you should only grant the necessary permissions required to perform that task. For more information, see Security best practices in IAM. In addition, you can use service control policies (SCPs) to manage and limit permissions in your organization. See General examples in the Organizations User Guide for more information on SCPs.
Parameters:
| Name | Type | Description | Default |
|---|---|---|---|
input
|
AssumeRootInput
|
An instance of |
required |
plugins
|
list[Plugin] | None
|
A list of callables that modify the configuration dynamically. Changes made by these plugins only apply for the duration of the operation execution and will not affect any other operation invocations. |
None
|
Returns:
| Type | Description |
|---|---|
AssumeRootOutput
|
An instance of |
Input¶
dataclass
¶
Dataclass for AssumeRootInput structure.
Attributes¶
class-attribute
instance-attribute
¶
duration_seconds: int | None = None
The duration, in seconds, of the privileged session. The value can range from 0 seconds up to the maximum session duration of 900 seconds (15 minutes). If you specify a value higher than this setting, the operation fails.
By default, the value is set to 900 seconds.
class-attribute
instance-attribute
¶
target_principal: str | None = None
The member account principal ARN or account ID.
class-attribute
instance-attribute
¶
task_policy_arn: PolicyDescriptorType | None = None
The identity based policy that scopes the session to the privileged tasks that can be performed. You must use one of following Amazon Web Services managed policies to scope root session actions:
Output¶
dataclass
¶
Dataclass for AssumeRootOutput structure.
Attributes¶
class-attribute
instance-attribute
¶
credentials: Credentials | None = None
The temporary security credentials, which include an access key ID, a secret access key, and a security token.
Note
The size of the security token that STS API operations return is not fixed. We strongly recommend that you make no assumptions about the maximum size.
class-attribute
instance-attribute
¶
source_identity: str | None = None
The source identity specified by the principal that is calling the
AssumeRoot operation.
You can use the aws:SourceIdentity condition key to control access
based on the value of source identity. For more information about using
source identity, see Monitor and control actions taken with assumed
roles
in the IAM User Guide.
The regex used to validate this parameter is a string of characters consisting of upper- and lower-case alphanumeric characters with no spaces. You can also include underscores or any of the following characters: =,.@-