Glossary
Role Assumption
Role assumption lets a principal temporarily adopt a different, scoped set of permissions — often in a different account or trust boundary entirely — for the duration of a specific task, rather than being issued standing credentials for that other context that persist indefinitely. The assumed role's permissions apply only while actively assumed, and typically expire automatically after a bounded duration rather than requiring an explicit action to revoke.
This is a direct application of just-in-time access to the specific problem of crossing account or trust boundaries: instead of provisioning a permanent credential in every account someone might occasionally need to act in, a single identity can assume a temporary, scoped role in whichever account a specific task actually requires, and the access disappears again once the task is done.