AWS IAM roles are a set of permissions that you can grant to users to control how they access AWS resources. They’re similar to user accounts, but with specific permissions for managing AWS resources.
You create IAM roles by using the AWS Management Console, the AWS Command Line Interface, or the AWS API. You then assign the role to users by granting them permissions to use the role.
You can grant users the following permissions for AWS IAM roles:
Access to AWS resources
Modification of AWS resources
Execution of AWS actions, such as AmazonEC2 instances launches and stops
The following table shows the most common permissions that you might grant to users in an IAM role.
Permission Description ReadAccess Grant read access to AWS resources. This includes the ability to view the contents of files on AWS resources and to read from standard input and output (SIN and SNI) on AWS resources. WriteAccess Grant write access to AWS resources. This includes the ability to create, delete, and modify files on AWS resources. ListAccess Grant list access to AWS resources. This includes the ability to view the contents of folders on AWS resources and to list the files and subdirectories in those folders.
CreateAccess Grant create access to AWS resources. This includes the ability to create new AWS resources. ModifyAccess Grant modify access to AWS resources. This includes the ability to update, change, or delete the contents of files on AWS resources. ExecuteAccess Grant execute access to AWS actions, such as AmazonEC2 instances launches and stops. This permission is required to use the AmazonEC2 actions module.
You can also grant users the following permissions if they are members of a role group:
ListAccess (for members of role groUPS)
CreateAccess (for members of role groUPS)
ModifyAccess (for members of role groUPS)
ReadAccess (for members of role groUPS)
WriteAccess (for members of role groUPS)
ExecuteAccess (for members of role groUPS)
The following table shows the most common permissions that you might grant to users in a role group.
Permission Description ListAccess (for role groUPS) Grant list access to AWS resources to all members of the role group. CreateAccess (for role groUPS) Grant create access to AWS resources to all members of the role group. ModifyAccess (for role groUPS) Grant modify access to AWS resources to all members of the role group. ReadAccess (for role groUPS) Grant read access to AWS resources to all members of the role group.
WriteAccess (for role groUPS) Grant write access to AWS resources to all members of the role group. ExecuteAccess (for role groUPS) Grant execute access to AWS actions to all members of the role group.
To create an IAM role, use the AWS Management Console, the AWS Command Line Interface, or the AWS API.
To assign a role to a user, use the AWS Management Console, the AWS Command Line Interface, or the AWS API.
To list the roles that a user has access to, use the AWS Management Console, the AWS Command Line Interface, or the AWS API.
To create a role, use the AWS Management Console, the AWS Command Line Interface, or the AWS API.
To create a role group, use the AWS Management Console, the AWS Command Line Interface, or the AWS API.
To assign a role group to a user, use the AWS Management Console, the AWS Command Line Interface, or the AWS API.
To conclude, AWS IAM roles are a set of permissions that you can grant to users to control how they access AWS resources. You use the AWS Management Console, the AWS Command Line Interface, or the AWS API to create the roles, and then you assign the roles to users by granting them permissions to use the roles. You can grant users the following permissions for AWS IAM roles: Access to AWS resources.
