Explain how AWS IAM Role assumption works across different AWS accounts securely.

Core Summary

One account can use another account's resources without a password or an access key ever changing hands. The role's trust policy decides who is allowed in, its permissions policy decides what they can do once they're there, and STS hands out credentials that expire on their own.