Amazon Web Services
docs.aws.amazon.com › aws identity and access management › user guide › iam identities › iam roles
IAM roles - AWS Identity and Access Management
For information about which services support using service-linked roles, see AWS services that work with IAM and look for the services that have Yes in the Service-Linked Role column. Choose a Yes with a link to view the service-linked role documentation for that service. For more information, see Create a service-linked role. ... Role chaining is when you use a role to assume a second role. You can perform role chaining through the AWS Management Console by switching roles, the AWS CLI, or API. For example, RoleA has permission to assume RoleB.
Amazon Web Services
docs.aws.amazon.com › aws identity and access management › user guide › access management for aws resources › policies and permissions in aws identity and access management › example iam identity-based policies
Example IAM identity-based policies - AWS Identity and Access Management
March 5, 2026 - Example policies: AWSExample policy: AWS Data ExchangeExample policies: AWS Data PipelineExample policies: Amazon DynamoDBExample policies: Amazon EC2Example policies: AWS Identity and Access Management (IAM)Example policies: AWS LambdaExample policies: Amazon RDSExample policies: Amazon S3 · A policy is an object in AWS that, when associated with an identity or resource, defines their permissions. AWS evaluates these policies when an IAM principal (user or role) makes a request.
IAM Roles and Groups.
Very wrong. An IAM group is not a principal. https://docs.aws.amazon.com/IAM/latest/UserGuide/intro-structure.html#intro-structure-principal More on reddit.com
38
21
March 30, 2024IAM roles - full list to-date
Without having access to AWS CLI or any AWS account in general, where are the current list of internal out-of-the-box IAM roles documented? As an example: AccountReadOnly or AccountMonitor I'v... More on repost.aws
1
0
October 5, 2023Help with IAM User and Role Guidelines
Great question and thinking - from a security perspective, we thank you for thing of IAM considerations first before using an overly permissive IAM Principal. I'll split this up into a couple categories: Overall: Does your organization have pre-existing AWS Access patterns or resources for you to follow? Every organization is different and I recommend following existing patterns or building on top of those. Do you have separate AWS Accounts for environments (Dev, Stage, Prod)? There are resources on Account separation as these provide logical boundaries. These accounts can all be part of the same Organization. For an enterprise, I'd typically recommend many accounts as this can provide security and also help with segmentation and reduce blast radius (example: someone manually accessing improper data or deleting resources). It sounds like you have multiple different access use cases with engineers, business users, ETL tools, reporting tools, vendors. This guide is useful: https://docs.aws.amazon.com/IAM/latest/UserGuide/IAMBestPracticesAndUseCases.html I'd also outline the following for the use cases: Who is accessing (engineers, data scientists, application, etc)? How are they trying to access (manual, automated)? What do they need access to? Mechanism of Access into AWS: IAM Users are a quick way to start, but I'd recommend IAM Roles and using Identity Center (AWS SSO) when possible. For different IAM roles, I usually split these up by "application". So if one workflow is reading from postgres and writing to S3, that would be 1 Role with the applicable polices. Then the Glue job loading from Redshift would be a different role. Example: https://docs.aws.amazon.com/glue/latest/dg/create-an-iam-role.html . For vendors delivering files - you could use S3 for this (as an example to not give them an IAM principal in your accounts): S3 Presigned URLs S3 Bucket Policies for cross account access Environment Differences: My preference is a more open IAM principal in Development environments for easier troubleshooting, and a more constrained IAM Principal (role) in Stage and Production. If you're building an application and doing more automation in Stage and Production, I'd suggest sticking more to IAM Roles and not IAM Users. If you do need access for data engineers to manually run things in Production, I'd recommend using Identity Center (AWS SSO). Permission-wise, I'd recommend scoping down/testing in Development and using those scoped down roles in Stage and Production. That's just a start but some considerations for you to think about! More on reddit.com
7
8
January 15, 2023Looking for examples of IAM roles for management console.
In addition to the other comment (which you should read - protect the root account immediately), you should get your head around basic IAM policies and permissions before you do this for your application. Giving a user specific access policies becomes basically the same thing as doing it for a role, so start there because that tends to make more sense to folks that haven't touched roles yet. As for examples, there are plenty out there - anything on Lambda will typically require a couple different roles. Or you could create an EC2 and give it an instance profile (a role) and then watch it access stuff via the CLI. Once you do this once or twice you'll probably get that lightbulb moment. More on reddit.com
1
1
May 21, 2023Videos
02:47
How to Create an IAM Role on AWS | IAM | Identity and Access ...
19:09
UPDATED - AWS Identity and Access Management (IAM) Basics | AWS ...
11:37
Finally Understand AWS IAM: Users, Roles, Policies & Trust (11-Min ...
08:12
AWS Solution Architect | Create Custom IAM Role and Policy - Part ...
17:24
AWS Assume IAM Role - Step by Step tutorial (Part-3) - YouTube
04:27
AWS IAM Roles | Amazon Web Services - YouTube
Medium
medium.com › @AlexanderObregon › understanding-aws-iam-roles-and-how-to-use-them-for-beginners-3047e34f22b8
Understanding AWS IAM Roles and How to Use Them for Beginners
December 1, 2025 - Learn how AWS IAM roles hand out short-lived access through trust rules and temporary credentials so beginners can work safely with services across an account.
AWS
docs.aws.amazon.com › aws cloudformation › template reference › aws identity and access management › aws::iam::role
AWS::IAM::Role - AWS CloudFormation
Returns the Amazon Resource Name (ARN) for the role. For example: ... This will return a value such as arn:aws:iam::1234567890:role/MyRole-AJJHDSKSDF.
Spacelift
spacelift.io › blog › aws-iam-roles
AWS IAM Roles - Everything You Need to Know & Examples
September 15, 2025 - Most AWS services rely on service roles to function properly. They allow AWS Cloudformation, for example, to create and delete resources on your behalf based on a YAML or JSON file. Another well-known example of a special type of service role is the EC2 IAM role.
Amazon Web Services
docs.aws.amazon.com › aws identity and access management › user guide › iam identities › iam roles › common scenarios for iam roles
Common scenarios for IAM roles - AWS Identity and Access Management
An application or a service offered by AWS (like Amazon EC2) can assume a role by requesting temporary security credentials for a role with which to make programmatic requests to AWS. You use a role this way so that you don't have to share or maintain long-term security credentials (for example, by creating an IAM user) for each entity that requires access to a resource.
AWS Fundamentals
awsfundamentals.com › blog › aws-iam-roles-terms-concepts-and-examples
An AWS IAM Roles Deep Dive: Terms, Concepts, and Examples
Let’s look at a simple example, a team that consists of four different roles: administrators, developers, quality assurance, and business analysts. Each of the roles can be put into a group for which fitting permissions are assigned. ...
Qloudx
qloudx.com › aws-iam-roles-types-use-cases
AWS IAM Roles: Types & Use Cases – QloudX
IAM roles are of 4 types, primarily differentiated by who or what can assume the role: ... A service role is assumed by an AWS service. When creating one of these, you can specify which AWS service you want to be able to assume this role & then assign the permissions that the service would have when it assumes the role. The most well-known example of a service role is the IAM role in an EC2 instance’s instance profile.
Amazon Web Services
docs.aws.amazon.com › amazon ec2 › user guide › security in amazon ec2 › identity and access management for amazon ec2 › iam roles for amazon ec2
IAM roles for Amazon EC2 - Amazon Elastic Compute Cloud
Specify the role when you launch ... credentials and use them. For example, you can use IAM roles to grant permissions to applications running on your instances that need to use a bucket in Amazon S3....
Reddit
reddit.com › r/aws › iam roles and groups.
r/aws on Reddit: IAM Roles and Groups.
March 30, 2024 -
So what's the purpose of having IAM Roles and Groups. I mean both does the same. Am I wrong?
Top answer 1 of 5
44
Very wrong. An IAM group is not a principal. https://docs.aws.amazon.com/IAM/latest/UserGuide/intro-structure.html#intro-structure-principal
2 of 5
25
IAM Roles: Purpose: Provide temporary security credentials for short-term access to AWS resources. Use Case: Roles are assumed by a user, service, or application to gain temporary access to resources without using permanent access keys. Key Feature: Permissions can change according to the role assumed, allowing for flexible access control. IAM Groups: Purpose: Organize IAM users into a single unit to manage permissions collectively. Use Case: Groups simplify the management of permissions for multiple users. Instead of assigning permissions to each user individually, you assign permissions to a group, and all users in the group inherit those permissions. Key Feature: Useful for managing permissions efficiently for users with similar access needs but doesn’t provide temporary access or assume dynamic roles. IAM Roles are for temporary credential management for entities needing fluctuating access, while IAM Groups organize users for easier permission management.
Amazon Web Services
docs.aws.amazon.com › aws identity and access management › user guide › iam identities › iam roles › iam role creation › create a role to give permissions to an iam user
Create a role to give permissions to an IAM user - AWS Identity and Access Management
You can use the AWS Management Console to create a role that an IAM user can assume. For example, assume that your organization has multiple AWS accounts to isolate a development environment from a production environment.
Amazon Web Services
aws.amazon.com › products › security, identity and compliance › aws identity and access management › iam features
IAM - Manage Roles
1 week ago - AWS Identity and Access Management (IAM) roles are entities you create and assign specific permissions to that allow trusted identities such as workforce identities and applications to perform actions in AWS. When your trusted identities assume IAM roles, they are granted only the permissions ...
GeeksforGeeks
geeksforgeeks.org › devops › iam-roles
IAM Roles - GeeksforGeeks
August 2, 2025 - Designed for mobile and web applications, these roles allow apps authenticated through OIDC providers (e.g., Cognito, Facebook) to access AWS resources. Users assume roles using web-identity tokens with STS operations like AssumeRoleWithWebIdentity. These are fully custom IAM roles created to be assumed by IAM users (in the same account) or other roles.
Amazon Web Services
docs.aws.amazon.com › aws identity and access management › user guide › iam identities › iam roles › iam role creation
IAM role creation - AWS Identity and Access Management
Create an IAM role from the AWS Management Console, the AWS CLI, or the IAM API.
Stackademic
blog.stackademic.com › understanding-aws-iam-roles-and-policies-a-comprehensive-guide-with-examples-1ae1a6a4e5f5
Understanding AWS IAM Roles and Policies: A Comprehensive Guide with Examples | by Bibek Poudel | Stackademic
October 9, 2023 - Policies can be attached to IAM users, groups, and roles, allowing you to control who can do what within your AWS environment. Let’s say you have an S3 bucket containing sensitive data. You can create a custom IAM policy that specifies which users or roles have read and write access to the bucket. Here’s an example of a simplified S3 bucket policy:
Amazon Web Services
docs.aws.amazon.com › aws identity and access management › user guide › iam tutorials › iam tutorial: delegate access across aws accounts using iam roles
IAM tutorial: Delegate access across AWS accounts using IAM roles - AWS Identity and Access Management
For Account ID, type the Originating account ID. This tutorial uses the example account ID 111111111111 for the Originating account. You should use a valid account ID. If you use an invalid account ID, such as 111111111111, IAM does not let you create the new role.
Amazon Web Services
docs.aws.amazon.com › aws command line interface › user guide for version 1 › authentication and access credentials for the aws cli › using an iam role in the aws cli
Using an IAM role in the AWS CLI - AWS Command Line Interface
For example, you could create a role-based profile as follows. [profile namedsessionrole] role_arn = arn:aws:iam::234567890123:role/SomeRole source_profile = default role_session_name = Session_Maria_Garcia
Medium
aws.plainenglish.io › aws-iam-roles-explained-best-practices-for-secure-service-permissions-e52dff94a13f
AWS IAM Roles Explained: Temporary Credentials, AssumeRole, and Best Practices | by Juan Andrés Leiva | AWS in Plain English
September 3, 2025 - Roles are the secure way to grant permissions between AWS accounts. Example: A user in Account A assumes a role in Account B using STS AssumeRole. This avoids sharing access keys across accounts.
Amazon Web Services
docs.aws.amazon.com › aws identity and access management › user guide › iam identities › iam roles › methods to assume a role › use an iam role to grant permissions to applications running on amazon ec2 instances
Use an IAM role to grant permissions to applications running on Amazon EC2 instances - AWS Identity and Access Management
March 5, 2026 - A developer launches an Amazon EC2 instance and assigns the Get-pics role to that instance. If you use the IAM console, the instance profile is managed for you and is mostly transparent to you. However, if you use the AWS CLI or API to create and manage the role and Amazon EC2 instance, then you must create the instance profile and assign the role to it as separate steps.