title: AWS IAM - Who is the Principal in the context of Assume Role?
body: <h1>Objective</h1>
  
  <p>Clear the confusion of what/who is the principal of an action being executed in AWS with assuming an IAM role.</p>
  
  <h1>Background</h1>
  
  <p>A IAM role has the tab of Trust relationships that defines who can assume the role.</p>
  
  <p><a href="https://i.stack.imgur.com/oMWhT.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/oMWhT.png" alt="enter image description here"></a></p>
  
  <p>It is described as in JSON.</p>
  
  <pre><code>statement {
    sid    = "1"
    effect = "Allow"
  
    principals {
      identifiers = ["elastictranscoder.amazonaws.com"]
      type        = "Service"
    }
    actions = ["sts:AssumeRole"]
  }
  </code></pre>
  
  <p>According to <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html" rel="nofollow noreferrer">Roles Terms and Concepts</a>, those who can assume the role must be either a user or a role.</p>
  
  <blockquote>
    <p>Principal<BR>
    An entity in AWS that can perform actions and access resources. A principal can be an AWS account root user, an IAM user, or a role. You can grant permissions to access a resource in one of two ways:</p>
    
    <p>Trust policy<BR>
    A document in JSON format in which you define who is allowed to assume the role. This trusted entity is included in the policy as the principal element in the document. </p>
  </blockquote>
  
  <h2>Question</h2>
  
  <p>Who/what is the principal if I issue the <a href="https://docs.aws.amazon.com/cli/latest/reference/sts/assume-role.html" rel="nofollow noreferrer">assume-role</a> command using my AWS account to get a temporary credential, and then run an action e.g. transcode video files? According to the AWS document, it must be either a user or a role. </p>
  
  <ol>
  <li>elastictranscoder.amazonaws.com?</li>
  <li>The role that defines the trusted relationship with elastictranscoder.amazonaws.com?</li>
  <li>My user account?</li>
  </ol>
  
  <p>If it is elastictranscoder.amazonaws.com, then:</p>
  
  <ol>
  <li>Is it this a user or a role?</li>
  <li>From Audit perspective, is elastictranscoder.amazonaws.com recorded as the principal who executed the action? Where can I identify who became elastictranscoder.amazonaws.com when and how?</li>
  </ol>