Modifying a role (Amazon API)

To modify a role trust policy (Amazon API)

1. (Optional) If you don't know the name of the role that you want to modify, call the following operation to list the roles in your account:

   • ListRoles

2. (Optional) To view the current trust policy for a role, call the following operation:

   • GetRole

3. To modify the trusted principals that can access the role, create a text file with the updated trust policy. You can use any text editor to construct the policy.

   For example, the following trust policy shows how to reference two Amazon Web Services accounts in the Principal element. This allows users within two separate Amazon Web Services accounts to assume this role.

   {
       "Version": "2012-10-17",
       "Statement": {
           "Effect": "Allow",
           "Principal": {"AWS": [
               "arn:aws-cn:iam::111122223333:root",
               "arn:aws-cn:iam::444455556666:root"
           ]},
           "Action": "sts:AssumeRole"
       }
   }

   If you specify a principal in another account, adding an account to the trust policy of a role is only half of establishing the cross-account trust relationship. By default, no users in the trusted accounts can assume the role. The administrator for the newly trusted account must grant the users the permission to assume the role. To do that, the administrator must create or edit a policy that is attached to the user to allow the user access to the sts:AssumeRole action. For more information, see the following procedure or Granting a user permissions to switch roles.

4. To use the file that you just created to update the trust policy, call the following operation:

   • UpdateAssumeRolePolicy

To allow users in a trusted external account to use the role (Amazon API)

For more information and detail about this procedure, see Granting a user permissions to switch roles.

1. Create a JSON file that contains a permissions policy that grants permissions to assume the role. For example, the following policy contains the minimum necessary permissions:

   {
     "Version": "2012-10-17",
     "Statement": {
       "Effect": "Allow",
       "Action": "sts:AssumeRole",
       "Resource": "arn:aws-cn:iam::ACCOUNT-ID-THAT-CONTAINS-ROLE:role/ROLE-NAME"
     }
   }

   Replace the ARN in the statement with the ARN of the role that the user can assume.

2. Call the following operation to upload the JSON file that contains the trust policy to IAM:

   • CreatePolicy

   The output of this operation includes the ARN of the policy. Make a note of this ARN because you will need it in a later step.

3. Decide which user or group to attach the policy to. If you don't know the name of the intended user or group, call one of the following operations to list the users or groups in your account:

   • ListUsers

   • ListGroups

4. Call one of the following operations to attach the policy that you created in the previous step to the user or group:

   • API: AttachUserPolicy

   • AttachGroupPolicy

To change the permissions allowed by a role (Amazon API)

1. (Optional) To view the current permissions associated with a role, call the following operations:

   1. ListRolePolicies to list inline policies

   2. ListAttachedRolePolicies to list managed policies

2. The operation to update permissions for the role differs depending on whether you are updating a managed policy or an inline policy.

   To update a managed policy, call the following operation to create a new version of the managed policy:

   • CreatePolicyVersion

   To update an inline policy, call the following operation:

   • PutRolePolicy

To change the description of a role (Amazon API)

1. (Optional) To view the current description for a role, call the following operation:

   • GetRole

2. To update a role's description, call the following operation with the description parameter:

   • UpdateRole

To change the maximum session duration setting for roles that are assumed using the API (Amazon API)

1. (Optional) To view the current maximum session duration setting for a role, call the following operation:

   • GetRole

2. To update a role's maximum session duration setting, call the following operation with the max-sessionduration CLI parameter or the MaxSessionDuration API parameter:

   • UpdateRole

   Your changes don't take effect until the next time someone assumes this role. To learn how to revoke existing sessions for this role, see Revoking IAM role temporary security credentials.

To change the managed policy used to set the permissions boundary for a role (Amazon API)

1. (Optional) To view the current permissions boundary for a role, call the following operation:

   • GetRole

2. To use a different managed policy to update the permissions boundary for a role, call the following operation:

   • PutRolePermissionsBoundary

   A role can have only one managed policy set as a permissions boundary. If you change the permissions boundary, you change the maximum permissions allowed for a role.