amazon-web-servicesamazon-iamrolessts

In AWS, why am I giving up existing permissions when assuming a role


When you assume a role (user, application or service), you give up your original permissions and take the permissions assigned to the role. Why can't new permissions from the assumed role be added to the existing ones? Is this to avoid potential security issues when existing and new policies are mixed up?


Solution

  • It would be against least privilege rule. A permissions in a single role should be just enough for a given task to be completed.

    Since a role can assume other role, and the other role can assume yet new role, and so on, the cumulative permissions after a chain of assumptions is against the least privilege rule.