IAM role management
Before a user, application, or service can use a role that you created, you must grant
permissions to switch to the role. You can use any policy attached to groups or users to grant
the necessary permissions. This section describes how to grant users permission to use a role.
It also explains how the user can switch to a role from the Amazon Web Services Management Console, the Tools for Windows PowerShell, the Amazon Command Line Interface
(Amazon CLI) and the AssumeRole
API.
Important
When you create a role programmatically instead of in the IAM console, you have an
option to add a Path of up to 512 characters in addition to the
RoleName, which can be up to 64 characters long. However, if you intend to use
a role with the Switch Role feature in the Amazon Web Services Management Console, then the combined
Path and RoleName cannot exceed 64 characters.
Topics
- View role access
- Generate a policy based on access information
- Grant a user permissions to switch roles
- Grant a user permissions to pass a role to an Amazon service
- Revoke IAM role temporary security credentials
- Update a service-linked role
- Update a role trust policy
- Update permissions for a role
- Update settings for a role
- Delete roles or instance profiles
View role access
Before you change the permissions for a role, you should review its recent service-level activity. This is important because you don't want to remove access from a principal (person or application) who is using it. For more information about viewing last accessed information, see Refine permissions in Amazon using last accessed information.
Generate a policy based on access information
You might sometimes grant permissions to an IAM entity (user or role) beyond what they require. To help you refine the permissions that you grant, you can generate an IAM policy that is based on the access activity for an entity. IAM Access Analyzer reviews your Amazon CloudTrail logs and generates a policy template that contains the permissions that have been used by the entity in your specified date range. You can use the template to create a managed policy with fine-grained permissions and then attach it to the IAM entity. That way, you grant only the permissions that the user or role needs to interact with Amazon resources for your specific use case. To learn more, see IAM Access Analyzer policy generation.