📖 What is AWS IAM Roles?
AWS IAM Roles are identities granting temporary access to AWS services without requiring long-term credentials. They are assumed by users, applications, or AWS services to perform specific actions. Roles enhance security by eliminating the need to embed access keys directly into code or distribute them to users.
"Roles are the preferred method for granting permissions to AWS resources. Understand the trust relationship component of a role, which defines who can assume it. Exam questions often involve scenarios where you must choose between using a role versus an IAM user with access keys."
📚 Certification: AWS Certified Solutions Architect - Associate (SAA-C03)
🔑 What are the Key Concepts of AWS IAM Roles?
- ▸ Roles define a set of permissions that can be assumed, providing temporary security credentials for access to AWS resources.
- ▸ A Trust Policy defines which entities (users, services, or accounts) are allowed to assume the role, controlling access.
- ▸ Roles are crucial for granting permissions to AWS services like EC2 instances or Lambda functions without hardcoding credentials.
- ▸ IAM Roles are preferred over IAM Users with access keys for security best practices and managing access at scale.
- ▸ AssumeRole API is used to request temporary credentials, and STS (Security Token Service) is the underlying service that provides them.
🎯 How does AWS IAM Roles appear on the SAA-C03 Exam?
You may be asked to identify the best way to allow an EC2 instance to access S3 buckets in another AWS account – a role with a cross-account trust policy is the correct answer.
A scenario might describe a Lambda function needing access to DynamoDB; expect questions about configuring a role with the necessary permissions and a trust relationship allowing Lambda to assume it.
Expect questions about choosing between using IAM users with long-term keys versus IAM roles for applications running on EC2 instances, focusing on security implications.
❓ Frequently Asked Questions
What's the difference between a Role and a Profile?
An IAM Role is an AWS identity with permissions, while an AWS Profile stores your personal AWS credentials (access key ID and secret access key) for use with the AWS CLI or SDKs. Roles are for AWS resources, profiles are for you.
Can a Role be assumed by an on-premises user?
Yes, but it requires configuring an AWS Security Token Service (STS) endpoint and using temporary credentials. The trust policy must allow the on-premises identity provider to assume the role.
How do I restrict a Role to only access resources within a specific VPC?
You can use Condition keys in the Role's Trust Policy to restrict access based on the VPC ID. This ensures the role can only be assumed from resources within that VPC, enhancing security.