Creating a Role

To create a role for an AWS service

1. In the navigation pane, click Roles, and then click Create New Role.

   

2. In the Role name box, enter a role name that can help you identify the purpose of this role.

   Because various entities might reference the role, you cannot edit the name of the role after it has been created.

3. Click AWS Service Roles, and then select the service that you will allow to assume this role.

4. Depending on the role that you selected, review the predefined policy or create a policy.

   1. If the role included a predefined policy, you can modify the policy name or policy document, and then click Continue to review the role.

   2. If the role that you selected doesn't include a predefined policy, select a method for creating the policy document by clicking Select Policy Template, Policy Generator, or Custom Policy.

      • Policy templates are predefined policies that have one or more permissions specified. If you are specifying permissions that match or are related to a template, select the template and then make any modifications on the next screen.

      • The policy generator helps you create permissions for a policy by providing drop-down menus where you can select services, actions, conditions, and keys. The generator creates the policy document for you.

      • If you want to fully write and customize a policy, select Custom Policy.

   3. How you complete the next step depends on the method you selected to create the policy.

      • If you are using a template to create the policy, review the policy content in the dialog box.

      • If you are using the policy generator, select the appropriate Effect, AWS Service, and Actions options, enter the ARN (if applicable), and add any conditions you want to include. Then click Add Statement. You can add as many statements as you want to the policy. When you are finished adding statements, click Continue.

        

      • If you are using a custom policy, enter a name for the policy under Policy Name and write the policy or paste the policy document from your text editor into the Policy Document box.

        

      Note

      There are limitations on policy names and on policy size. For information about policy limitations, see Limitations on IAM Entities.

5. Click Continue to review the role.

6. After reviewing the role, click Create Role to complete the wizard.

To create a role that IAM users can assume

1. In the navigation pane of the console, click Roles, and then click Create New Role.

   

2. In the Role name box, enter a role name that can help you identify the purpose of this role.

   Because various entities might reference the role, you cannot edit the name of the role after it has been created.

3. Click Roles for Cross-Account Access, and then select the type of role that you want to create.

4. Specify an AWS account ID that you want to establish trust with.

   Any IAM user from the trusted AWS account can assume this role, as long as they are granted permission to call the role.

5. If you selected a role for a third party, enter the external ID provided by the third party.

   For more information about the external ID, see About the External ID.

6. Click Continue.

7. Set the permissions for the role to specify what actions can be done on specific resources (similar to setting permissions for IAM groups).

   The permissions that you specify are available to entities that assumes the role. By default, roles have no permissions.

   1. Choose the method for creating the policy document by clicking Select Policy Template, Policy Generator, or Custom Policy, and then click Select.

      • Policy templates are predefined policies that have one or more permissions specified. If you are specifying permissions that match or are related to a template, select the template and then make any modifications on the next screen.

      • The policy generator helps you create permissions for a policy by providing drop-down menus where you can select services, actions, conditions, and keys. The generator creates the policy document for you.

      • If you want to fully write and customize a policy, select Custom Policy.

   2. How you complete the next step depends on the method you selected to create the policy.

      • If you are using a template to create the policy, review the policy content in the dialog box.

      • If you are using the policy generator, select the appropriate Effect, AWS Service, and Actions options, enter the ARN (if applicable), and add any conditions you want to include. Then click Add Statement. You can add as many statements as you want to the policy. When you are finished adding statements, click Continue.

        

      • If you are using a custom policy, enter a name for the policy under Policy Name and write the policy or paste the policy document from your text editor into the Policy Document box.

        

      Note

      There are limitations on policy names and on policy size. For information about policy limitations, see Limitations on IAM Entities.

   3. Click Continue to review the role.

8. After reviewing the role, click Create Role to complete the wizard.

To create a role with the CLI

1. Create a role by entering the following command: iam-rolecreate -r role_name [-f policy_document_file | -s service_endpoint.

   For the role's trust policy, you can specify a file location or a service endpoint. The policy document file can contain multiple entities that can assume the role and any conditions for assuming the role.

2. Associate a policy to the role by entering the following command: iam-roleaddpolicy -r role_name -p policy_name -e Allow_or_Deny {-a action ...} {-c ARN ...}.

3. If you are launching an Amazon EC2 instance with this role, create and add the role to an instance profile by entering the following command: iam-instanceprofilecreate -r role_name -s instance_profile_name.

   An instance profile is a container for a role. Each instance profile can contain only one role. For more information about instance profiles, see Instance Profiles.

To create a role with the API

1. Create a role by calling CreateRole with the role name and role trust policy.

2. Associate a policy to the role by calling PutRolePolicy with the policy document, policy name, and role name.

3. If you are launching an Amazon EC2 with this role, you must complete the following steps:

   1. Create an instance profile by calling CreateInstanceProfile with the instance profile name.

   2. Add the role to the instance profile by calling AddRoleToInstanceProfile with the role name and instance profile name.

      An instance profile is a container for a role. Each instance profile can contain only one role. For more information about instance profiles, see Instance Profiles.