IAM - Roles

IAM Roles

Roles in AWS has special meaning. With this functionality you can define different variety of roles and assign it users or your application/service can use them.

Roles are specifically important for AWS security. Because roles use temporary credentials with services. So that we don't need to use own permanent credentials to do some operations. If somehow hackers got access to AWS infrastructure they won't able to access our cached permanent  credentials.

Here are some of advantages of using roles :

• Reduced Risk of Credential Exposure
• Least Privilege Principle
• Cross-Account Access 

Let's create a role and assign it to the user 

1. Click to "IAM" , "Roles" and then "Create role" button. 
   
   
   
2. We need ARN (we talked about this in the previous post) of the user. Copy 12 digit unique ID.



3. During role creation select "AWS account" since we are planning to add this role to user. Enter the ID we got from previous step. This ID defines our user it is unique and allows us to specify this role to this specific user.
   
   
   
4. 
   Add permissions to this user, since I am planning to grant S3 bucket access to this user, I have added S3FullAccess permission to this role.
   

   
5. 
   
   
   
   Add description and name for this role.
   

   
6. After creating the role it will be listed here.            
7. In order to switch to this role, click the name of the role and copy the link.
8. When you first open the link, will face with the error message. But why ?!
9. Okay it might be little hard to understand but, when we create new user by default all the permissions linked to that user are disabled. So is the role related permissions. We need to grant another permission to our user, so that user can take that role.
   

   

   
   
   
10. Navigate to the users section in IAM. Create a inline policy.
11. Switch to JSON view and add the permission below to the test user.
    
    

    
    
    
12. After that your test user will able to use this role.