amazon-web-services - AWS 控制台连续两次可传递地切换角色

Question

我使用 AWS 控制台在同一账户 (account1) 上将我的角色从 A 切换到 B。然后我想从 B 切换到另一个帐户(account2)上的角色 C。从 A 到 B 的切换有效，但从 B 到 C 的切换无效。

B 信任 arn:aws:iam::account1.id:role/A

C 信任 arn:aws:iam::account2.id:role/B

这是 AWS 的限制，还是应该可以传递性地切换角色？

Answer 1

我找到了答案，无法在 AWS 控制台中传递性地切换角色

基于此 AWS documentation :

When you switch roles in the AWS Management Console, the console always uses your original credentials to authorize the switch. This applies whether you sign in as an IAM user, as a SAML-federated role, or as a web-identity federated role. For example, if you switch to RoleA, it uses your original user or federated role credentials to determine if you are allowed to assume RoleA. If you then try to switch to RoleB while you are using RoleA, your original user or federated role credentials are used to authorize your attempt, not the credentials for RoleA.