Go to Master Account IAM -> Policies -> Create Policy
{ "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "PASTE ARN HERE" } }