Set up an IAM service role for Amazon GameLift

To create a role for an Amazon Web Service (IAM console)

1. Sign in to the Amazon Web Services Management Console and open the IAM console at https://console.amazonaws.cn/iam/.

2. In the navigation pane of the IAM console, choose Roles, and then choose Create role.

3. Choose the Amazon Web Service role type.

4. Choose the use case for your service. Use cases are defined by the service to include the trust policy that the service requires.

5. Choose Next.

6. If possible, select the policy to use for the permissions policy. Otherwise, choose Create policy to open a new browser tab and create a new policy from scratch. For more information, see Creating IAM policies in the IAM User Guide.

7. After you create the policy, close that tab and return to your original tab. Select the check box next to the permissions policies that you want the service to have.

   Depending on the use case that you selected, the service might let you do any of the following:

   • Nothing, because the service defines the permissions for the role.

   • Choose from a limited set of permissions.

   • Choose from any permissions.

   • Select no policies at this time. However, you can create the policies later, and then attach them to the role.

8. (Optional) Set a permissions boundary. This is an advanced feature that is available for service roles, but not for service-linked roles.

   Expand the Permissions boundary section and choose Use a permissions boundary to control the maximum role permissions. IAM includes a list of the Amazon managed and customer managed policies in your account. Select the policy to use for the permissions boundary or choose Create policy to open a new browser tab and create a new policy from scratch. For more information, see Creating IAM policies in the IAM User Guide. After you create the policy, close that tab and return to your original tab to select the policy to use for the permissions boundary.

9. Choose Next.

10. For Role name, the degree of role name customization is defined by the service. If the service defines the role's name, you can't edit this option. In other cases, the service might define a prefix for the role and you can enter an optional suffix. For some services, you can specify the entire name of your role.

    If possible, enter a role name or role name suffix to help you identify the purpose of this role. Role names must be unique within your Amazon Web Services account, so don't create roles named both PRODROLE and prodrole. When a role name is used in a policy or as part of an ARN, the role name is case sensitive. When a role name appears to customers in the console, such as during the sign-in process, the role name is case insensitive. Because various entities might reference the role, you can't edit the name of the role after it is created.

11. (Optional) For Description, enter a description for the new role.

12. Choose Edit in the Step 1: Select trusted entities or Step 2: Select permissions sections to edit the use cases and permissions for the role.

13. (Optional) Add metadata to the role by attaching tags as key-value pairs. For more information about using tags in IAM, see Tagging IAM resources in the IAM User Guide.

14. Review the role, and then choose Create role.