title: Does the service user calling sts's assume_role need access to an s3 bucket in order to make credentials granting access to that bucket?
body: <p>I have a service user for boto3 to make calls to sts. If I want to make temporary credentials for access to a bucket on s3, does the user that makes the call to sts need access to that s3 bucket or is the inline policy below enough? <strong>NOTE:</strong> This is NOT the policy I pass to assume_role, this is the inline policy that the service user has attached.</p>
  <pre><code>{
    &quot;Version&quot;: &quot;2012-10-17&quot;,
    &quot;Statement&quot;: [
      {
        &quot;Action&quot;: [
          &quot;sts:AssumeRole&quot;
        ],
        &quot;Effect&quot;: &quot;Allow&quot;
      }
    ]
  }
  </code></pre>
  <p>Basically, do I need to include &quot;s3: *&quot; in another statement?</p>