To know how cross-account works, created user1 in the root account and role in another account.
In a trust relationship, the principal is given as below.
"AWS": "arn:aws:iam::root"
As far as I know When we try to access the services in a cross account STS API call will happen, which returns the security credential back to the account which needs access.
In root accounts, we won't directly give STS call policy, then how come I was allowed to switch back to the cross-account and access resources?