IAM Roles for Services

🔐 What is IAM?

IAM (Identity and Access Management) is AWS’s way of controlling who can do what in your AWS environment. IAM helps you manage access to AWS services and resources securely.

🤖 What is an IAM Role?

An IAM Role is an AWS identity with a set of permissions (a permissions policy) but no username or password. It defines what actions are allowed or denied on specific resources.

Unlike IAM users, roles are not associated with a specific person or service — instead, they can be assumed temporarily by trusted entities, like:

• AWS services (e.g., EC2, Lambda, ECS)

• Other AWS accounts

• Users/federated identities (SSO, Active Directory, etc.)

Two policy types

• Trust Policy (Who can wear the badge) - This is the list of approved wearers. It says exactly which AWS service, user, or account is allowed to pick up and use the badge. For example: “Only EC2 instances can assume this role.”

• Permissions Policy (“What can they do with it?”) - This is the set of rules printed on the badge itself. It spells out what actions the badge‐holder is allowed to perform—like “read files from bucket X” or “write logs to CloudWatch.”

So:

1. Trust policy = who’s allowed to grab the role.

2. Permissions policy = what they’re allowed to do once they have it.

---

🛠️ Example: EC2 Instance Accessing S3

Problem:

You want an EC2 instance to read files from an S3 bucket, but you don't want to store or hardcode AWS access keys on the instance. Because:

• Hardcoding AWS credentials is insecure.

• If your EC2 instance gets compromised, your AWS Access Key and Secret Key could be stolen.

• It’s hard to rotate/expire hardcoded credentials.

Solution

1. Create an IAM Role with permissions to access S3 (e.g., s3:GetObject).

2. Attach this role to your EC2 instance when you launch it (or later).

3. The EC2 instance will then assume the IAM Role automatically.

4. The instance can now securely call S3 APIs using temporary credentials provided by AWS.

✅ No need to store long-term credentials. AWS handles temporary credentials behind the scenes.

---

🔁 How IAM Roles for Services Work

1. You define a trust policy — who can assume the role (e.g., ec2.amazonaws.com, lambda.amazonaws.com).

2. You define a permissions policy — what actions are allowed (e.g., access to S3, DynamoDB, etc.).

3. AWS automatically rotates and manages the temporary credentials for the service using the role.

---

Common Service-Role Types

---

Further Reading & AWS Docs

• IAM Roles Overview

• AWS Instance Profiles for EC2

• Service-Linked Roles

More AWS SAA Articles

• AWS IAM User, Root User and Groups

• AWS IAM Policies and their structure

Follow me for more such content

• My YouTube Channel

• My Site

• My Blogs

• LinkedIn

• Instagram

• Twitter

• Stackoverflow

• Github

• Dev