How AWS IAM role manager rethinks the starting point for IAM roles

<p>When you build a new application or capability on <span class="LinkEnhancement"><a class="Link" href="https://aws.amazon.com/" target="_blank" rel="noopener" data-cms-ai="0">Amazon Web Services (AWS)</a></span>, you want to focus on what you’re building. Getting a service running almost always begins with <span class="LinkEnhancement"><a class="Link" href="https://aws.amazon.com/iam" target="_blank" rel="noopener" data-cms-ai="0">AWS Identity and Access Management (IAM)</a></span>. Many AWS services that act on your behalf need an IAM role, an identity the service assumes to access your resources with a defined set of permissions. You then author a trust policy so the service can assume the role, choose the permissions the workload needs, and attach it. Configuring roles and policies for common patterns is repeatable work that doesn’t need to be manual.</p>

<p>IAM role manager does that work for you. When role manager is enabled, AWS creates and configures the IAM roles as you build in supported service consoles, so you can start using a service and let AWS handle the role behind it. You create the resource you want, and role manager provisions and attaches the role you need as part of the same flow, so you can build now and refine permissions as your workload matures.</p>

<p>With that step automated, getting started takes minutes. You can create an <span class="LinkEnhancement"><a class="Link" href="https://aws.amazon.com/lambda" target="_blank" rel="noopener" data-cms-ai="0">AWS Lambda</a></span> function and start running your code, with its execution role already created and attached, without switching context to set one up. Role creation becomes an automated part of building your application rather than a separate step.</p>

<p>Role manager is especially useful when you’re getting started: the moments when you want to stand up a service or get a proof of concept running and want to defer role configuration until later in your development process. You don’t need prior IAM experience to get started. You keep full control of what it creates, because the roles are ordinary IAM roles that you can view, edit, or delete like any role you author yourself. When you want to tighten a role, <span class="LinkEnhancement"><a class="Link" href="https://aws.amazon.com/iam/access-analyzer" target="_blank" rel="noopener" data-cms-ai="0">AWS IAM Access Analyzer</a></span> reviews how it has been used and recommends a policy scoped to only the permissions it needs.</p>

<h2>How to enable role manager</h2>

</div>

<p>Role manager has two states, enabled and disabled. Enabling it for an account authorizes AWS to create roles in that account. In an organization, administrators can use a service control policy (SCP) to control whether member accounts can enable or use role manager. To enable it:</p>

<li>Open the IAM console and choose <b>Account settings</b>.</li>

<li>In the <b>role manager</b> section, choose <b>Enable</b>.</li>

</ol>

<p></p>

<p id="caption-attachment-43282" class="wp-caption-text">Figure 1: Enable Role Manager</p>

</div>

<p></p>

<p>Some AWS services already create a role for you when you create a resource that needs one. Role manager doesn’t change that: those services keep creating roles automatically, and roles you already created keep working. What role manager adds is a single account-level control, and coverage for a case that built-in flows can’t handle: tasks whose permissions AWS can’t determine in advance, such as running your own code. For those tasks, role manager provisions a role that you can narrow later.</p>

<h2>Example: Create an Amazon EventBridge rule</h2>

</div>

<p>Start with a common task: an <span class="LinkEnhancement"><a class="Link" href="https://aws.amazon.com/eventbridge" target="_blank" rel="noopener" data-cms-ai="0">Amazon EventBridge</a></span> rule that invokes a target, such as an <span class="LinkEnhancement"><a class="Link" href="https://aws.amazon.com/sqs" target="_blank" rel="noopener" data-cms-ai="0">Amazon Simple Queue Service (