AWS: restrict use of assume role to same account in organization

Viewed 26

I have an SSO role that I want to deploy to many of my accounts within my AWS Organization, and I cant customise each role policy for each account.

I want to restrict the user in the role from using the Action sts:AssumeRole where the Account ID is different from the current one.

The closest I could get to finding a solution here might be using the condition keys for aws:SourceAccount, and aws:PrincipalAccount. I just dont know how I could stitch that together in a policy doc properly, or if what I want to do is even possible

0 Answers
Related