Roles may not be assumed by root accounts

Question

How do I use the thufir profile I created, and not use the AWS root account?

I'm on page 12 of the AWS Command Line Interface User Guide:

thufir@doge:~$ 
thufir@doge:~$ cat .aws/config 
[default]
output = text
region = us-west-2



[profile thufir]
role_arn = arn:aws:iam::1234567890:user/thufir
source_profile = default

thufir@doge:~$ 
thufir@doge:~$ aws iam list-users
USERS   arn:aws:iam::1234567890:user/thufir 2017-01-02T10:09:01Z    /   ABCDEFGIJKL thufir
thufir@doge:~$ 
thufir@doge:~$ aws s3 ls --profile thufir

An error occurred (AccessDenied) when calling the AssumeRole operation: Roles may not be assumed by root accounts.
thufir@doge:~$ 
thufir@doge:~$ export AWS_DEFAULT_PROFILE=thufir
thufir@doge:~$ 
thufir@doge:~$ aws s3 ls --profile thufir

An error occurred (AccessDenied) when calling the AssumeRole operation: Roles may not be assumed by root accounts.
thufir@doge:~$ 

Page 12 of the AWS Command Line Interface User Guide says:

After creating the role, modify the trust relationship to allow the IAM user to assume it. The following example shows a trust relationship that allows a role to be assumed by an IAM user named jonsmith :

{
  "Version": "2012-10-17",
  "Statement": [
  {
    "Sid": "",
    "Effect": "Allow",
    "Principal": {
      "AWS": "arn:aws:iam::123456789012:user/jonsmith"
    },
  "Action": "sts:AssumeRole"
}

Is that done locally in a config file physically on my machine, or through a website, or...?

I think this may relate to roles rather than a profile as I have configured.

Answer 1

Roles may not be assumed by root accounts.

This error means exactly what it says.

You cannot assume a role while using a root account, under any circumstances. You have to use an IAM account.

There is no other workaround for this. The behavior is by design.

per:

https://stackoverflow.com/a/37334769/262852