CS Techie
Comments
courseAWS
AWS lesson

IAM Roles in AWS

​IAM roles in AWS are a fundamental security feature that allow you to delegate access to AWS resources without sharing long-term credentials (such as passwords or access keys). Unlike IAM users, roles are not associated with a specific person or service by default. Instead, they can be assumed by trusted entities, such as IAM users, AWS services, or external identities.​

Key Characteristics of IAM Roles

  • Temporary Credentials: When a role is assumed, AWS provides temporary security credentials with the permissions defined in the role’s policies.
  • No Long-Term Credentials: Roles do not have passwords or access keys attached to them by default.
  • Assumable by Trusted Entities: Roles can be assumed by IAM users, AWS services (like EC2, Lambda), or external users (via identity federation or cross-account access).
  • Fine-Grained Permissions: Permissions are defined using IAM policies attached to the role, specifying what actions are allowed and on which resources.


Common Use Cases

  • EC2 Instance Roles: Assign a role to an EC2 instance to allow it to access other AWS services (e.g., S3, DynamoDB) securely, without embedding credentials in the application code.
  • Cross-Account Access: Allow users or services in one AWS account to access resources in another account by assuming a role.
  • AWS Service Access: Grant AWS services (such as Lambda functions or ECS tasks) permissions to interact with other AWS resources.
  • Federated Access: Allow external identities (such as corporate users authenticated via SAML or OIDC) to assume roles and access AWS resources.


Example

Suppose you want an EC2 instance to read objects from an S3 bucket. You would:

  1. Create an IAM role with a policy that allows s3:GetObject on the desired bucket.
  2. Attach the role to the EC2 instance.
  3. The application running on the instance can now access the S3 bucket using the temporary credentials provided by the role. 


Further Reading

For more details, refer to the official AWS IAM roles documentation. If you need an example policy or guidance on creating and using roles, please specify your requirement.