---

IAM Role

An IAM role in AWS is an identity that provides temporary security credentials to trusted entities, such as AWS services, users, or applications. Unlike IAM users, IAM roles do not have long-term credentials (such as passwords or access keys). Instead, roles are assumed by users or services that need access to specific AWS resources, and temporary security credentials are issued for that role.

---

Key Characteristics of IAM Roles:

1. No Permanent Credentials:

• Roles do not have static passwords or access keys. Instead, they provide temporary security credentials (Access Key ID, Secret Access Key, and Session Token), which are valid for a limited period (typically between 15 minutes to 12 hours).

1. Can Be Assumed Temporarily:

• AWS services, users, or external identity providers can assume a role to gain access to AWS resources. Once the role is assumed, temporary credentials are issued, allowing access based on the role’s policies.

1. Fine-Grained Permissions:

• When you create a role, you define a policy that specifies the permissions for the role. The permissions allow or deny access to AWS resources and actions.
• You can also define trust policies that specify who or what is allowed to assume the role.

1. Cross-Account Access:

• IAM roles can be used to allow access between different AWS accounts. For example, you can create a role in one AWS account that users or services in another AWS account can assume.

Common Use Cases for IAM Roles:

1. Granting Permissions to AWS Services:

• Roles are commonly used to grant AWS services (like EC2 or Lambda) permissions to interact with other AWS resources.
• Example: An EC2 instance can assume a role to access S3 buckets, without needing to embed AWS credentials in the instance.

1. Federated Access:

• IAM roles can allow users from external identity providers (such as corporate directories using SAML) to access AWS resources.
• Example: Employees from a company using Active Directory can use their existing credentials to log into the AWS console by assuming a role via SAML.

1. Cross-Account Access:

• Roles are useful for managing access between multiple AWS accounts.
• Example: Developers in one AWS account can assume a role that grants them access to resources in another AWS account, simplifying cross-account resource management.

1. AWS Services Assuming Roles:

• AWS services like Lambda, EC2, ECS, and AWS Batch often use roles to access other resources.
• Example: A Lambda function can assume a role that grants it permission to read from a DynamoDB table or write to an S3 bucket.

Steps to Create and Use an IAM Role:

1. Create an IAM Role:

• In the AWS Management Console, create a new IAM role.
• Define the trust policy that specifies who can assume the role (for example, an AWS service like EC2 or a specific user).

1. Attach Policies to the Role:

• Attach permissions policies to the role that define what AWS actions and resources the role can access. For instance, a policy might allow the role to access specific S3 buckets, manage EC2 instances, or read from DynamoDB.

1. Assume the Role:

• AWS services, users, or applications assume the role. Once assumed, the role provides temporary security credentials to the entity.
• For programmatic access, AWS SDKs or the AWS CLI can assume roles via the sts:AssumeRole API.

1. Temporary Security Credentials:

• Once a role is assumed, AWS generates temporary security credentials that are valid for a limited period (15 minutes to 12 hours). These credentials are used to interact with AWS resources based on the permissions attached to the role.

Example Scenario of Using IAM Role:

Scenario: You have an EC2 instance that needs to interact with an S3 bucket to store log files.

1. Create a Role for EC2:

• In the AWS Management Console, create a role that allows EC2 instances to assume it. Attach an S3 policy to the role that grants read/write access to the S3 bucket.

1. Attach the Role to the EC2 Instance:

• When launching the EC2 instance, attach the IAM role to it. The EC2 instance will now be able to use the permissions specified in the role.

1. Use the Role in the Application:

• The application running on the EC2 instance can now use the temporary credentials associated with the role to interact with the S3 bucket (e.g., storing or retrieving log files).

1. Temporary Security Credentials:

• The temporary credentials provided by the role are automatically rotated, ensuring that long-term credentials don’t need to be stored or managed in the application code.

IAM Role Types:

1. Service Role:

• Roles used by AWS services (e.g., EC2, Lambda) to perform actions on your behalf.
• Example: A service role for EC2 allows an instance to interact with other AWS services.

1. Assumed Role:

• Roles that can be assumed by users, applications, or AWS services. This role is used when you explicitly call the sts:AssumeRole action.
• Example: A developer assumes a role that grants access to specific AWS resources for a time-limited period.

1. Cross-Account Role:

• A role that allows entities from one AWS account to access resources in another account.
• Example: Users in Account A assume a role in Account B to access resources.

1. Federation Role:

• Roles used for federated users who authenticate through an external identity provider (e.g., via SAML or web identity federation).
• Example: Users from a corporate directory can assume a federation role to access the AWS console using their enterprise credentials.

Best Practices for IAM Roles:

1. Use Roles for AWS Services: Instead of embedding credentials in your application code (e.g., for EC2 or Lambda), use IAM roles to provide secure, temporary access to resources.
2. Follow the Principle of Least Privilege: Attach only the necessary permissions to roles to limit the potential for unauthorized access.
3. Use Roles for Cross-Account Access: When sharing resources across AWS accounts, use roles to manage access securely and avoid hard-coding access keys.
4. Enable Role Monitoring: Monitor role usage with AWS CloudTrail to detect unusual activity or unauthorized access attempts.

---

In summary, IAM roles are a flexible and secure way to manage permissions and access control within AWS. By allowing entities to assume roles and use temporary credentials, AWS ensures that sensitive credentials are not exposed while maintaining fine-grained control over who can access specific resources.