What Is an Assume Role Chain?
An assume role chain is a series of role assumptions in which each role is used to assume the next, forming a path from an initial identity to a final set of permissions. It is common when crossing account boundaries or stepping up privileges in stages. Each link in the chain is governed by its own trust relationship.
Why it matters
Chaining lets a pipeline reach resources in another account without sharing static keys. Each hop is auditable, but a weak link anywhere in the chain undermines the whole path.
Related guides
What Is a Trust Relationship?A trust relationship is the policy defining which external identities a role or resource will accept, control…
What Is a Token Exchange Flow?A token exchange flow is trading one trusted token for another, letting a pipeline swap its identity token fo…
What Is a Scoped Deploy Key?A scoped deploy key is a credential granting access to a single repository, often read-only, so a pipeline ge…