We now we need to create a policy in our Auth Account. Remember that this is the account that the users Lucille and Buster will initially log in to when visiting the AWS console. We actually want to give them extremely limited access to this account. In fact, the only thing we're going to let them do is attempt to switch to a role in the application account.

1. Visit the IAM console in the Auth Account and create a new policy:

2. Call this policy AllowAssumeRole. Give it a description to help you remember what it's for. Then apply the following policy document. You are going to want to make sure the account number of the App Account is added to your policy:

      { 
        "Version": "2012-10-17", 
        "Statement": [ 
            { 
              "Sid": "Stmt1487396837000", 
              "Effect": "Allow", 
              "Action": [ 
                  "sts:AssumeRole" 
              ], 
              "Resource": [ 
                  "arn:aws:iam::<app-acct-number>:role/*" 
              ] 
            } 
        ] 
      }