I'm trying to setup a policy for a AWS IAM Role to limit assuming the role to a specific group, but I wasn't able to find how to do it ( or if it's not possible ) from googling and the AWS Documentation.

I'm creating a role ( called ops ) which will be used by humans to perform operations on the AWS infrastructure. Our requirement is that multi-factor is enabled to get to this role ( even from CLI or API ). My further requirement would be to permit assuming the role only to users belonging to a specific group ( called operators ).

The policy attached to ops that I currently developed is this ( account number replaced ):

    "Version": "2012-10-17", 
    "Statement": [
            "Action": "sts:AssumeRole", 
            "Effect": "Allow", 
            "Condition": {
                "Bool": {
                    "aws:MultiFactorAuthPresent": "true"
            "Principal": {
                "AWS": "arn:aws:iam::xxxxxxxxxxxx:root"

How can I add a further condition to restrict assuming this role only to operators?

Is this even possible?

Thank you!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.