Aws cli - Role chaining - Use a master role in primary account to assume a secondary role in other account

Question

I need to assume a temp role in a secondary account from a primary account. For primary account I already have a role which has an assume role policy for the temp role in secondary role. But when I am executing the command

aws sts assume-role --role-arn ${primaryRoleArn} --role-session-name ${awsProfile}

I am getting this error

An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:iam::xxxxxxx:user/primary is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::secondaryAccount:role/secondary_role

What I am doing wrong?

Answer 1

Your credentials in your ~/.aws/credentials file must be explicitly allowed to assume this role. So in primary role trust policy, you must add your username to allowed assumption.

"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::${AccountId}:user/${AwsUserName}"
        },
        "Action": "sts:AssumeRole"
    }
]