assumeRoot method

Future<AssumeRootResponse> assumeRoot({ required String targetPrincipal, required PolicyDescriptorType taskPolicyArn, int? durationSeconds, })

Returns a set of short term credentials you can use to perform privileged tasks on a member account in your organization. You must use credentials from an Organizations management account or a delegated administrator account for IAM to call AssumeRoot. You cannot use root user credentials to make this call.

Before you can launch a privileged session, you must have centralized root access in your organization. For steps to enable this feature, see Centralize root access for member accounts in the IAM User Guide. You can track AssumeRoot in CloudTrail logs to determine what actions were performed in a session. For more information, see Track privileged tasks in CloudTrail in the IAM User Guide.

When granting access to privileged tasks you should only grant the necessary permissions required to perform that task. For more information, see Security best practices in IAM. In addition, you can use service control policies (SCPs) to manage and limit permissions in your organization. See General examples in the Organizations User Guide for more information on SCPs.

May throw ExpiredTokenException. May throw RegionDisabledException.

Parameter targetPrincipal : The member account principal ARN or account ID.

Parameter taskPolicyArn : The identity based policy that scopes the session to the privileged tasks that can be performed. You must use one of following Amazon Web Services managed policies to scope root session actions:

• IAMAuditRootUserCredentials
• IAMCreateRootUserPassword
• IAMDeleteRootUserCredentials
• S3UnlockBucketPolicy
• SQSUnlockQueuePolicy

Parameter durationSeconds : The duration, in seconds, of the privileged session. The value can range from 0 seconds up to the maximum session duration of 900 seconds (15 minutes). If you specify a value higher than this setting, the operation fails.

By default, the value is set to 900 seconds.

Implementation

Future<AssumeRootResponse> assumeRoot({
  required String targetPrincipal,
  required PolicyDescriptorType taskPolicyArn,
  int? durationSeconds,
}) async {
  _s.validateNumRange(
    'durationSeconds',
    durationSeconds,
    0,
    900,
  );
  final $request = <String, String>{
    'TargetPrincipal': targetPrincipal,
    for (var e1 in taskPolicyArn.toQueryMap().entries)
      'TaskPolicyArn.${e1.key}': e1.value,
    if (durationSeconds != null)
      'DurationSeconds': durationSeconds.toString(),
  };
  final $result = await _protocol.send(
    $request,
    action: 'AssumeRoot',
    version: '2011-06-15',
    method: 'POST',
    requestUri: '/',
    exceptionFnMap: _exceptionFns,
    resultWrapper: 'AssumeRootResult',
  );
  return AssumeRootResponse.fromXml($result);
}