IAM role

An identity with permissions that something can "wear" temporarily. No password.

Think of it as: A visitor badge that's handed out at the door and expires.

What to know for Level 0

Software gets AWS permissions from a role, never from stored access keys: an instance profile on EC2, a task role on ECS, an execution role on Lambda.
A role's trust policy says who may assume it (for example ec2.amazonaws.com); its permissions policy says what it can do once assumed.

More detail

Roles are how software gets AWS permissions. On EC2 the role comes through an instance profile, on ECS it’s the task role, and on Lambda it’s the execution role. A role’s trust policy says who may wear it; its permissions policy says what the wearer can do.

Quiz yourself on IAM role →

← All terms