# IAM roles created by the Systems Manager console
<a name="cloud-connector-gcp-console-iam-roles"></a>

When you create a Cloud Connector in the Systems Manager Amazon Web Services Management Console, Systems Manager creates and configures three IAM roles in your Amazon Web Services account on your behalf. It also assigns a managed instance role to the GCP virtual machines registered through the connector. The roles establish the trust chain between Systems Manager, State Manager, Automation, and GCP through OIDC federation. This trust chain lets Systems Manager run Automation runbooks against your GCP virtual machines without long-lived secrets.

Each role name uses the pattern `SSM-GCP{{Type}}-{{connector-name}}`, where {{connector-name}} is the display name you provided (sanitized to alphanumeric characters, dashes, and underscores, then truncated to fit IAM's 64-character role-name limit). The Amazon Web Services Management Console appends a unique suffix to each role name to keep it unique. The roles are created in the `/service-role/` IAM path.

The console creates the roles in this order:

1. GCP federation role, with a trust policy that initially names only the Systems Manager service principal as a trusted entity.

1. Automation assume role and automation dispatch role.

1. The console then updates the GCP federation role's trust policy to add the automation assume role and the automation dispatch role as trusted principals. After this update, the trust policy is the one shown in [GCP federation role](cloud-connector-gcp-federation-role.md).

**Note**  
The Systems Manager console creates these roles only during the Cloud Connector setup wizard. If you create a Cloud Connector with the Amazon CLI (as described in [Step 2: Create a Systems Manager Cloud Connector](cloud-connector-gcp-create-ssm-connector.md)), you must create the roles yourself. The trust and permissions policies in this section show the JSON you can use to recreate them. If you recreate the roles, do the following:  
Create all three roles (GCP federation, automation assume, and automation dispatch) in the `/service-role/` IAM path. The permissions policies and the GCP federation role's trust policy reference the roles by ARNs that include this path.
Tag the automation assume role and the automation dispatch role with the principal tag `caller=SSM`. The GCP federation role's trust policy requires this tag.

All API calls that these roles make are logged to Amazon CloudTrail (CloudTrail). For information about Systems Manager logging in CloudTrail, see [Logging Amazon Systems Manager API calls with Amazon CloudTrail](monitoring-cloudtrail-logs.md).