Role-based permission delegation in a provider network

A method for role-based permission delegation in a provider network, the method comprising:

• sending, by a first entity in the provider network, a request to assume a first role, the first role comprising a first permission policy, the first permission policy of the first role allowing assumption of a second role under a condition, the second role comprising a second permission policy, the second permission policy of the second role allowing a set of actions on a resource, the condition requiring the second role to be assumed with permission to perform a strict subset of the set of actions on the resource;
• sending, by the first entity acting in the first role, a request to assume the second role, the request requesting permission to perform the strict subset of actions on the resource;
• and
• performing, by the first entity acting in the second role with permission to perform a strict subset of the set of actions on the resource, a particular action on the resource in the strict subset.

A system comprising:

• a first one or more electronic devices to implement an assuming service in a provider network, the assuming service comprising instructions which when executed cause the assuming service to:
• send a request to assume a delegation role, the delegation role comprising a permission policy, the permission policy of the delegation role allowing assumption of a customer role under a condition, the customer role comprising a permission policy, the permission policy of the customer role allowing a set of actions on a customer resource, the condition requiring the customer role to be assumed with permission to perform a strict subset of the set of actions on the customer resource;
• send a request to assume the customer role, the request requesting permission to perform the strict subset of actions on the customer resource;
• and
• perform a particular action on the customer resource in the strict subset;
• a second one or more electronic devices to implement a temporary credential service in the provider network, the temporary credential service having instructions which when executed cause the temporary credential service to:
• receive the request to assume the delegation role;
• send temporary security credentials for acting in the delegation role;
• receive the request to assume the customer role;
• and
• send temporary security credentials for acting in the customer role with permission to perform the strict subset of the set of actions on the customer resource.