Cross account assume role inside organization

Question

Hi,
I have an AWS organization with multiple account (`root_account`, `account_1`, `account_2`, ... `account_n`). What I'm trying to do is, starting from an user in `root_account`, be able to assume role in any of the others organization accounts (`account_x`).
In every `account_x` I've created a role `account_example_role` with the following trust relationship:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam:::role/root_example_role"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}
```

while in `root_account` I have the role `root_example_role` with the following plicy:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "sts:AssumeRole"
            ],
            "Resource": [
                "arn:aws:iam:::role/account_example_role",
                "arn:aws:iam:::role/account_example_role",
                ...
                "arn:aws:iam:::role/account_example_role"
            ]
        }
    ]
}
```

and this seems to work, but it's hard to maintain.

I was wondering if there is a way to specify an organization wide role arn inside the `root_example_role` policy, something like this:

```
"Resource": "arn:aws:organizations:::organization/o-/role/account_example_role"
```

so that it's no longer needed to update the `root_example_role` policy for every new account in the organization.

Answer

IAM roles are linked to a particular AWS account an not to the whole organization. So you still need to mention each account's role arn in the `root_example_role` policy

Answer

I wonder if a [Global condition](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principalorgid) would work in this situation. Something like this:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "sts:AssumeRole"
            ],
            "Resource": [
                "arn:aws:iam::*:role/account_example_role"
            ].
            "Condition": { "StringEquals": { "aws:ResourceOrgID": "${aws:PrincipalOrgID}"  }  }
        }
    ]
}
```

Cross account assume role inside organization

Relevant content