[unkoman]

Principal can be any AWS resource, such as Kinesis firehose or Lambda. Whichever resource that needs the permissions. For example:

            "Statement": [{
                "Effect": "Allow",
                "Principal": {"Service": [
                    "firehose.amazonaws.com"
                                          ]
                              },
                "Action": ["sts:AssumeRole"]
            }
            ]
        }