Each IAM role that you want to make available in Britive must allow the account access manager service to assume it. Unlike an AWS or AWS Identity Center application, this application type does not use SAML for the role that is checked out. The role requires no Britive identity provider entry and no SAML conditions.
Add the following statement to the trust policy of each role:
{
"Effect": "Allow",
"Principal": { "Service": "account-access.amazonaws.com" },
"Action": ["sts:AssumeRole", "sts:SetContext"],
"Condition": {
"StringEquals": {
"aws:SourceAccount": "<management-account-id>",
"aws:SourceArn": "<account-access-manager-arn>"
}
}
}Both sts:AssumeRole and sts:SetContext are required.
sts:SetContext allows the account access manager to attach the IAM Identity Center identity context to the session. A role whose trust policy omits either action is discovered during a scan but cannot be added to a profile.
Roles are configured per account. Scan each AWS account whose roles you intend to grant.
Creating an IAM Policy in AWS
If AWS Identity Center is not integrated with Britive, you need to create an IAM policy and role in AWS. For more information, see Creating IAM Roles in AWS.