{"Statement":[{"Action":"sts:AssumeRole","Condition":{"StringEquals":{"sts:ExternalId":"CUSTOMER_CHOSEN_EXTERNAL_ID"}},"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::VENDOR_ACCOUNT_ID:root"}}],"Version":"2012-10-17"}