AWS IAM documentation change

Service: IAM · 2025-06-25 · Documentation low

File: IAM/latest/UserGuide/sts_example_sts_AssumeRole_section.md

Summary

Added multiple PowerShell V5 examples for AssumeRole including MFA and ExternalId usage

Security assessment

The examples document security best practices including MFA integration and ExternalId usage for cross-account role assumption, which are important for secure credential management and third-party access control

Diff

diff --git a/IAM/latest/UserGuide/sts_example_sts_AssumeRole_section.md b/IAM/latest/UserGuide/sts_example_sts_AssumeRole_section.md
index bfda11a5d..24fc7ddd5 100644
--- a//IAM/latest/UserGuide/sts_example_sts_AssumeRole_section.md
+++ b//IAM/latest/UserGuide/sts_example_sts_AssumeRole_section.md
@@ -555,0 +556,32 @@ PowerShell
+**Tools for PowerShell V5**
+    
+
+**Example 1: Returns a set of temporary credentials (access key, secret key and session token) that can be used for one hour to access AWS resources that the requesting user might not normally have access to. The returned credentials have the permissions that are allowed by the access policy of the role being assumed and the policy that was supplied (you cannot use the supplied policy to grant permissions in excess of those defined by the access policy of the role being assumed).**
+    
+    
+    Use-STSRole -RoleSessionName "Bob" -RoleArn "arn:aws:iam::123456789012:role/demo" -Policy "...JSON policy..." -DurationInSeconds 3600
+    
+
+**Example 2: Returns a set of temporary credentials, valid for one hour, that have the same permissions that are defined in the access policy of the role being assumed.**
+    
+    
+    Use-STSRole -RoleSessionName "Bob" -RoleArn "arn:aws:iam::123456789012:role/demo" -DurationInSeconds 3600
+    
+
+**Example 3: Returns a set of temporary credentials supplying the serial number and generated token from an MFA associated with the user credentials used to execute the cmdlet.**
+    
+    
+    Use-STSRole -RoleSessionName "Bob" -RoleArn "arn:aws:iam::123456789012:role/demo" -DurationInSeconds 3600 -SerialNumber "GAHT12345678" -TokenCode "123456"
+    
+
+**Example 4: Returns a set of temporary credentials that have assumed a role defined in a customer account. For each role that the third party can assume, the customer account must create a role using an identifier that must be passed in the -ExternalId parameter each time the role is assumed.**
+    
+    
+    Use-STSRole -RoleSessionName "Bob" -RoleArn "arn:aws:iam::123456789012:role/demo" -DurationInSeconds 3600 -ExternalId "ABC123"
+    
+
+  * For API details, see [AssumeRole](https://docs.aws.amazon.com/powershell/v5/reference) in _AWS Tools for PowerShell Cmdlet Reference (V5)_. 
+
+
+
+