Assume Role CLI Command Generator

The aws sts assume-role command has a lot of optional flags that only apply in specific situations - an external ID here, an MFA serial number and token code there, a non-default session duration - and getting the flag names or their order slightly wrong is a common source of a confusing CLI error message instead of a working set of temporary credentials. Assume Role CLI Command Generator builds the exact command from a small form, using real AWS CLI v2 flag names, so you can copy one working line into a terminal instead of re-deriving it from documentation each time.

Two fields are always required: the target role's ARN and a role session name. The role ARN is checked with a simple, local structural rule - it must parse as an iam-service ARN with resource type role (the arn:aws:iam::ACCOUNT-ID:role/ROLE-NAME shape) - catching an obviously wrong value (a user ARN, an S3 ARN, a typo missing the role/ segment) before you copy a command that AWS CLI would reject anyway. This is a syntax check only: it cannot confirm the role actually exists in AWS or that your credentials are allowed to assume it.

Three optional flags cover the common hardening and delegation scenarios trust policies impose on the caller. An External ID becomes --external-id, matching the value a role's trust policy may require under an sts:ExternalId condition. An MFA serial number and the current token code become --serial-number and --token-code together, for roles whose trust policy requires aws:MultiFactorAuthPresent. A duration in seconds becomes --duration-seconds, validated locally against the range AWS STS itself enforces for AssumeRole - 900 seconds (15 minutes) up to 43200 seconds (12 hours) - though the role's own MaxSessionDuration setting may cap it further in practice, something this tool cannot see or check.

Every value is wrapped in double quotes in the generated command, matching how AWS CLI examples conventionally show these flags, so values are copy-paste safe even if they contain characters a shell would otherwise treat specially. What this tool cannot do is guarantee the command will succeed: that depends on the calling identity actually having sts:AssumeRole permission against this specific role (see the Assume Role Policy Generator) and the role's trust policy actually trusting that caller (see the IAM Trust Policy Generator or IAM Role Trust Relationship Generator) - both configured entirely outside this tool, on the AWS side.

• Real AWS CLI v2 syntax for aws sts assume-role.
• Local structural validation of the role ARN (must be an iam role ARN, not just any ARN).
• Required fields - role ARN and role session name - enforced before a command is built.
• Optional External ID, MFA serial + token code, and duration flags, each added only when filled in.
• Duration validated against STS's real 900-43200 second range.
• Copy-paste safe quoting of every value.
• Sample scenario preloaded with a realistic cross-account MFA example.
• 100% client-side - nothing typed here is uploaded.

1. Enter the target role ARN.
2. Enter a role session name.
3. Optionally fill in External ID, if the target role's trust policy requires one.
4. Optionally fill in MFA serial number and token code, if the trust policy requires MFA.
5. Optionally set a session duration in seconds (900-43200).
6. Click Generate command.
7. Copy the command and run it in a terminal where AWS CLI is configured with credentials allowed to call sts:AssumeRole on that role.

Example 1 - minimal. Role ARN arn:aws:iam::123456789012:role/DeployRole, session name deploy-session - produces the shortest valid command.

Example 2 - cross-account with External ID. Role ARN in a partner account, External ID partner-42 - matches a trust policy requiring that exact external ID.

Example 3 - MFA-protected role. Serial number arn:aws:iam::111111111111:mfa/alice, token code the current 6-digit code from the device - required when the trust policy has an aws:MultiFactorAuthPresent condition.

Example 4 - short-lived session. Duration 900 for the minimum 15-minute session, useful for a single narrow operation.

Example 5 - invalid ARN caught. Entering an S3 or IAM user ARN instead of a role ARN produces a specific validation error before any command is generated.

• No flag-name guessing - real AWS CLI v2 syntax every time.
• Catches an obviously wrong ARN before you paste a doomed command into a terminal.
• Duration validated against STS's real limits, not just accepted blindly.
• Covers the common MFA and External ID cases in the same form.
• Private - nothing you type leaves your browser.