title: Access denied when assuming role as IAM user via boto3
body: <p><strong>Issue</strong></p>
  
  <p>I have an IAM user, and an IAM role. I am trying to configure the IAM user to have permission to assume the IAM role using STS. I am not sure why I receive an "Access Denied" error. </p>
  
  <p><strong>Details</strong></p>
  
  <p>IAM role: <code>arn:aws:iam::123456789:role/athena_access</code></p>
  
  <p>IAM user: <code>arn:aws:iam::123456789:user/athena-external-user</code></p>
  
  <p>IAM user policy to allow assume role:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "StsAssumeRole",
              "Effect": "Allow",
              "Action": "sts:*",
              "Resource": "arn:aws:iam::123456789:role/athena_access"
          }
      ]
  }
  </code></pre>
  
  <p>Code:</p>
  
  <pre><code>import boto3
  os.environ['AWS_ACCESS_KEY_ID'] = '...'
  os.environ['AWS_SECRET_ACCESS_KEY'] = '...'
  
  client = boto3.client('sts')
  role_to_assume_arn='arn:aws:iam::123456789:role/athena_access'
  role_session_name='test_session'
  response=client.assume_role(
      RoleArn=role_to_assume_arn,
      RoleSessionName=role_session_name
  )
  </code></pre>
  
  <p>Error:</p>
  
  <blockquote>
    <p>botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:iam::123456789:user/athena-external-user is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::123456789:role/athena_access</p>
  </blockquote>