Service-linked role

A role an AWS service creates and owns so it can act in your account on its own behalf.

Think of it as: A contractor's own access badge, issued and controlled by the contractor's company.

What to know for Level 0

A service-linked role is created and owned by an AWS service and named AWSServiceRoleFor… (RDS has AWSServiceRoleForRDS). You can't edit its permissions, and SCPs don't apply to it.

More detail

For example, AWSServiceRoleForRDS lets RDS manage network interfaces and monitoring for your databases. You can’t change its permissions, it only trusts that one service, and you can delete it only once the service no longer needs it. Compare a normal service role, which you create and hand to a service using iam:PassRole.

Quiz yourself on Service-linked role →

← All terms