Получение AWS Производственных параметров из хранилища параметров против QA

Question

В AWS QA env Я могу получить AWS параметры из хранилища параметров.

My username in QA AWS cloud is abc.xyz (firstName=abc, lastName=xyz) I do the following and I am able to get the parameters from AWS parameter store no problem using :     RoleArn-QA = "arn:aws:iam::12345:role/mySecrets"

    stsClient = boto3.client('sts')
    assumedRoleObject = stsClient.assume_role(RoleArn=RoleArn-QA, RoleSessionName=RoleSessionName, ExternalId = ExternalId)
    session = Session(aws_access_key_id=assumedRoleObject['Credentials']['AccessKeyId'],
                      aws_secret_access_key=assumedRoleObject['Credentials']['SecretAccessKey'])
    client = session.client('sts')
    accessKey = str(assumedRoleObject['Credentials']['AccessKeyId'])
    secretKey = str(assumedRoleObject['Credentials']['SecretAccessKey'])
    SessionToken = str(assumedRoleObject['Credentials']['SessionToken'])
    store = EC2ParameterStore(
        aws_access_key_id=accessKey,
        aws_secret_access_key=secretKey,
        aws_session_token=SessionToken,
        region_name=awsRegion)

Тем не менее, в prod указано мое имя пользователя в prod: axyz, этот пользователь является доверенным пользователем для роли ARN mySecrets или (arn: aws: iam :: 6789: role / mySecrets)

    RoleArn-Prod = "arn:aws:iam::6789:role/mySecrets"

Когда я запускаю аналогичный код для Prod с новым RoleArn-Prod

       stsClient = boto3.client('sts')
    assumedRoleObject = stsClient.assume_role(RoleArn=RoleArn-Prod, RoleSessionName=RoleSessionName, ExternalId = ExternalId)
    session = Session(aws_access_key_id=assumedRoleObject['Credentials']['AccessKeyId'],
                      aws_secret_access_key=assumedRoleObject['Credentials']['SecretAccessKey'])
    client = session.client('sts')
    accessKey = str(assumedRoleObject['Credentials']['AccessKeyId'])
    secretKey = str(assumedRoleObject['Credentials']['SecretAccessKey'])
    SessionToken = str(assumedRoleObject['Credentials']['SessionToken'])
    store = EC2ParameterStore(
        aws_access_key_id=accessKey,
        aws_secret_access_key=secretKey,
        aws_session_token=SessionToken,
        region_name=awsRegion)

Я получаю эту ошибку

botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:iam::12345:user/abc.xyz is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::6789:role/mySecrets