:doc:`STS <../../sts>` / Client / assume_root

***********
assume_root
***********



.. py:method:: STS.Client.assume_root(**kwargs)

  

  Returns a set of short term credentials you can use to perform privileged tasks on a member account in your organization. You must use credentials from an Organizations management account or a delegated administrator account for IAM to call ``AssumeRoot``. You cannot use root user credentials to make this call.

   

  Before you can launch a privileged session, you must have centralized root access in your organization. For steps to enable this feature, see `Centralize root access for member accounts <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-enable-root-access.html>`__ in the *IAM User Guide*.

   

  .. note::

    

    The STS global endpoint is not supported for AssumeRoot. You must send this request to a Regional STS endpoint. For more information, see `Endpoints <https://docs.aws.amazon.com/STS/latest/APIReference/welcome.html#sts-endpoints>`__.

    

   

  You can track AssumeRoot in CloudTrail logs to determine what actions were performed in a session. For more information, see `Track privileged tasks in CloudTrail <https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-track-privileged-tasks.html>`__ in the *IAM User Guide*.

   

  When granting access to privileged tasks you should only grant the necessary permissions required to perform that task. For more information, see `Security best practices in IAM <https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html>`__. In addition, you can use `service control policies <https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html>`__ (SCPs) to manage and limit permissions in your organization. See `General examples <https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples_general.html>`__ in the *Organizations User Guide* for more information on SCPs.

  

  See also: `AWS API Documentation <https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRoot>`_  


  **Request Syntax**
  ::

    response = client.assume_root(
        TargetPrincipal='string',
        TaskPolicyArn={
            'arn': 'string'
        },
        DurationSeconds=123
    )
    
  :type TargetPrincipal: string
  :param TargetPrincipal: **[REQUIRED]** 

    The member account principal ARN or account ID.

    

  
  :type TaskPolicyArn: dict
  :param TaskPolicyArn: **[REQUIRED]** 

    The identity based policy that scopes the session to the privileged tasks that can be performed. You must use one of following Amazon Web Services managed policies to scope root session actions:

     

    
    * `IAMAuditRootUserCredentials <https://docs.aws.amazon.com/IAM/latest/UserGuide/security-iam-awsmanpol.html#security-iam-awsmanpol-IAMAuditRootUserCredentials>`__
     
    * `IAMCreateRootUserPassword <https://docs.aws.amazon.com/IAM/latest/UserGuide/security-iam-awsmanpol.html#security-iam-awsmanpol-IAMCreateRootUserPassword>`__
     
    * `IAMDeleteRootUserCredentials <https://docs.aws.amazon.com/IAM/latest/UserGuide/security-iam-awsmanpol.html#security-iam-awsmanpol-IAMDeleteRootUserCredentials>`__
     
    * `S3UnlockBucketPolicy <https://docs.aws.amazon.com/IAM/latest/UserGuide/security-iam-awsmanpol.html#security-iam-awsmanpol-S3UnlockBucketPolicy>`__
     
    * `SQSUnlockQueuePolicy <https://docs.aws.amazon.com/IAM/latest/UserGuide/security-iam-awsmanpol.html#security-iam-awsmanpol-SQSUnlockQueuePolicy>`__
    

    

  
    - **arn** *(string) --* 

      The Amazon Resource Name (ARN) of the IAM managed policy to use as a session policy for the role. For more information about ARNs, see `Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces <https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html>`__ in the *Amazon Web Services General Reference*.

      

    
  
  :type DurationSeconds: integer
  :param DurationSeconds: 

    The duration, in seconds, of the privileged session. The value can range from 0 seconds up to the maximum session duration of 900 seconds (15 minutes). If you specify a value higher than this setting, the operation fails.

     

    By default, the value is set to ``900`` seconds.

    

  
  
  :rtype: dict
  :returns: 
    
    **Response Syntax**

    
    ::

      {
          'Credentials': {
              'AccessKeyId': 'string',
              'SecretAccessKey': 'string',
              'SessionToken': 'string',
              'Expiration': datetime(2015, 1, 1)
          },
          'SourceIdentity': 'string'
      }
      
    **Response Structure**

    

    - *(dict) --* 
      

      - **Credentials** *(dict) --* 

        The temporary security credentials, which include an access key ID, a secret access key, and a security token.

         

        .. note::

          

          The size of the security token that STS API operations return is not fixed. We strongly recommend that you make no assumptions about the maximum size.

          

        
        

        - **AccessKeyId** *(string) --* 

          The access key ID that identifies the temporary security credentials.

          
        

        - **SecretAccessKey** *(string) --* 

          The secret access key that can be used to sign requests.

          
        

        - **SessionToken** *(string) --* 

          The token that users must pass to the service API to use the temporary credentials.

          
        

        - **Expiration** *(datetime) --* 

          The date on which the current credentials expire.

          
    
      

      - **SourceIdentity** *(string) --* 

        The source identity specified by the principal that is calling the ``AssumeRoot`` operation.

         

        You can use the ``aws:SourceIdentity`` condition key to control access based on the value of source identity. For more information about using source identity, see `Monitor and control actions taken with assumed roles <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html>`__ in the *IAM User Guide*.

         

        The regex used to validate this parameter is a string of characters consisting of upper- and lower-case alphanumeric characters with no spaces. You can also include underscores or any of the following characters: =,.@-

        
  
  **Exceptions**
  
  *   :py:class:`STS.Client.exceptions.RegionDisabledException`

  
  *   :py:class:`STS.Client.exceptions.ExpiredTokenException`

  