In the world of AWS security, we’ve learned how to create IAM users for people and why it’s crucial to enable MFA. But what happens when an AWS service, like an EC2 instance, needs permission to access another service, like an S3 bucket? You wouldn’t create a “user” for a server and store a password on it—that would be a major security risk. This is where you must understand what is an IAM role.
An IAM Role is one of the most powerful and important security concepts in AWS. While it might seem confusing at first, mastering its use is the key to building secure, automated, and scalable cloud applications.
This ultimate guide will break down exactly what an IAM role is, how it differs from a user, and provide practical examples of how it’s used everyday.
What is an IAM Role? (Quick Answer)
For those looking for a quick summary, here is the answer:
An IAM Role is a secure way to grant permissions to entities that you trust. It is an AWS identity with permission policies that determine what the identity can and cannot do in AWS. However, instead of being uniquely associated with one person, a role is intended to be “assumed” by anyone or any service that needs it. It does not have its own long-term credentials like a password or access keys.
The Core Problem: How Do You Give Permissions to a Machine?
Let’s imagine you have an EC2 instance (a virtual server) that runs a photo-processing application. Every time a user uploads a photo, the application needs to save that photo to an S3 bucket.
How do you give the EC2 instance permission to write to S3?
- The Bad Way: You could create an IAM user, generate a permanent Access Key and Secret Access Key for that user, and then store those secret keys directly on the EC2 instance. The application would then use these keys to access S3. This is a terrible security practice. If an attacker ever gained access to your server, they could steal these permanent keys and gain full access to your S3 bucket.
- The Secure Way: You create an IAM Role. This role has a policy attached that grants permission to write to S3. You then “attach” this role to the EC2 instance. The EC2 instance can then “assume” the role and automatically receive temporary, rotating security credentials to access S3. There are no permanent keys stored on the server. This is the secure, professional method.
IAM Role vs. IAM User: The Definitive Analogy
The difference between a user and a role can be confusing. The best way to understand it is with a simple analogy: The Hotel Key Card.
- An IAM User is like a permanent employee ID badge. It belongs to one specific person (e.g., John Doe, the front desk clerk). It has their name on it, and it grants them a fixed set of permissions, like accessing the front desk computer and the staff room. It’s a long-term identity.
- An IAM Role is like a “Manager on Duty” key card. This key card doesn’t belong to any single person. It sits securely at the front desk. When a trusted employee needs to perform a manager’s task (like opening the cash office), they temporarily “assume the role” by taking the manager’s key card. While they have that card, they have all the manager’s permissions. When they are finished, they put the card back, and their special permissions are gone.
The key takeaway is that a user has credentials, while a role is credentials.
A user is an identity; a role is a temporary set of permissions that a trusted identity can assume.
The Two Policies of an IAM Role
Every IAM Role is defined by two critical JSON policy documents.
1. The Trust Policy (Who Can Assume the Role?)
This is the most important part of a role. The Trust Policy answers the question: “Who do I trust to wear this hat?” It specifies the “principal” entities that are allowed to assume the role.
A principal can be:
- An AWS Service (e.g.,
ec2.amazonaws.com) - Another AWS Account
- A Web Identity Provider (like Google or Facebook)
Example Trust Policy: This policy says, “I trust any EC2 instance to assume this role.”
JSON
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
2. The Permissions Policy (What Can the Role Do?)
This is identical to the policies you attach to users or groups. It answers the question: “What permissions does this hat grant?” It defines the specific Allow or Deny permissions for various AWS services.
Example Permissions Policy: This policy says, “Anyone who assumes this role is allowed to put objects into the stacklab-photo-bucket.”
JSON
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::stacklab-photo-bucket/*"
}
]
}
A role is only functional when both policies are in place. The Trust Policy opens the door, and the Permissions Policy defines what you can do once you’re inside.
Common Use Cases for IAM Roles
IAM Roles are used everywhere in AWS to build secure applications. Here are the most common scenarios you will encounter.
Granting Permissions to AWS Services (The EC2 Role)
This is the most common use case. You create a role that trusts the EC2 service and attach a permissions policy to it. Then, when you launch an EC2 instance, you attach this role. The instance can then automatically get temporary credentials to access other services like S3 or DynamoDB without needing hard-coded keys.
Cross-Account Access
Imagine your company has two AWS accounts: one for development and one for production. You can create a role in the production account that “trusts” the development account. This allows developers to temporarily “assume a role” to access specific resources in the production account without needing a separate user login for it. This is essential for managing multi-account environments securely.
Web Identity Federation
If you have a mobile or web application that uses a sign-in provider like “Login with Google” or “Login with Facebook,” you can use an IAM role to grant those authenticated users temporary, limited access to your AWS resources. For example, after logging in, a user could assume a role that gives them permission to upload a file directly to a specific folder within your S3 bucket.
Conclusion: The Secure Foundation for Automation
So, what is an IAM role? It is the secure and modern way to delegate permissions in AWS. By using roles, you eliminate the need to store long-lived, static credentials on your servers or in your application code. You embrace a model of temporary, automatically-rotating credentials that dramatically improves your security posture.
Understanding the difference between a user (a permanent identity) and a role (a temporary set of permissions) is a fundamental concept. By mastering the use of IAM roles, you unlock the ability to build secure, automated, and scalable applications on AWS.
FAQ: AWS IAM Roles
Can an IAM user assume a role?
Yes. This is a very common pattern. You can create a user with very few permissions and then grant them the ability to assume a role with higher privileges when they need to perform a specific administrative task.
Is there a cost associated with using IAM roles?
No. AWS Identity and Access Management (IAM), including the use of users, groups, policies, and roles, is a feature of your AWS account offered at no additional charge.
Why is using a role more secure than using an access key on an EC2 instance?
An access key stored on an instance is a permanent credential. If the server is compromised, the key is stolen and can be used indefinitely until it is manually revoked. A role provides temporary credentials that automatically expire and rotate, significantly reducing the window of opportunity for an attacker.