We now we need to create a policy in our Auth Account. Remember that this is the account that the users Lucille and Buster will initially log in to when visiting the AWS console. We actually want to give them extremely limited access to this account. In fact, the only thing we're going to let them do is attempt to switch to a role in the application account.
- Visit the IAM console in the Auth Account and create a new policy:
AWS refers to this type of policy as a Customer Managed Policy.
- Call this policy AllowAssumeRole. Give it a description to help you remember what it's for. Then apply the following policy ...
