AWS IAM: Updated role assumption with account access manager
Summary
Modified sign-in example to include account access manager as a role assignment method.
Security assessment
Documents an additional authorization method for role assumption, improving access control clarity.
Evidence
+When you sign in as a user in IAM Identity Center, as a SAML-federated role, or as a web-identity federated role you assume an IAM role when you start your session. For example, when a user in IAM Identity Center signs in to the AWS access portal they can choose a permission set or access a role assigned through [account access manager](./account-access-manager.html) before they can access AWS resources.
Diff
diff --git a/IAM/latest/UserGuide/id_roles_use_switch-role-console.md b/IAM/latest/UserGuide/id_roles_use_switch-role-console.md index 9e9f9a7fd..16cc0eb83 100644 --- a//IAM/latest/UserGuide/id_roles_use_switch-role-console.md +++ b//IAM/latest/UserGuide/id_roles_use_switch-role-console.md @@ -19 +19 @@ When you switch roles in the AWS Management Console, the console always uses you -When you sign in as a user in IAM Identity Center, as a SAML-federated role, or as a web-identity federated role you assume an IAM role when you start your session. For example, when a user in IAM Identity Center signs in to the AWS access portal they must choose a permission set that correlates to a role before they can access AWS resources. +When you sign in as a user in IAM Identity Center, as a SAML-federated role, or as a web-identity federated role you assume an IAM role when you start your session. For example, when a user in IAM Identity Center signs in to the AWS access portal they can choose a permission set or access a role assigned through [account access manager](./account-access-manager.html) before they can access AWS resources.