Update permissions for a role

Use the following procedures to update a role's permissions policies and permissions boundaries.

Prerequisite: View role access

Before you change the permissions for a role, you should review its recent service-level activity. This is important because you don't want to remove access from a principal (person or application) who is using it. For more information about viewing last accessed information, see Refine permissions in AWS using last accessed information.

Update the permissions policy for a role

To change the permissions allowed by the role, modify the role's permissions policy (or policies). You cannot modify the permissions policy for a service-linked role in IAM. You might be able to modify the permissions policy within the service that depends on the role. To check whether a service supports this feature, see AWS services that work with IAM and look for the services that have Yes in the Service-linked roles column. Choose a Yes with a link to view the service-linked role documentation for that service.

Updating a role permissions policy (console)

To change the permissions allowed by a role (console)

1. Open the IAM console at https://console.aws.amazon.com/iam/.

2. In the navigation pane of the IAM console, choose Roles.

3. Choose the name of the role that you want to modify, and then choose the Permissions tab.

4. Do one of the following:

   • To edit an existing customer managed policy, choose the name of the policy and then choose Edit policy.

     Note

     You cannot edit an AWS managed policy. AWS managed policies appear with the AWS icon ( ). For more information about the difference between AWS managed policies and customer managed policies, see Managed policies and inline policies.

   • To attach an existing managed policy to the role, choose Add permissions and then choose Attach policies.

   • To edit an existing inline policy, expand the policy and choose Edit.

   • To embed a new inline policy, choose Add permissions and then choose Create inline policy.

   • To remove an existing policy from the role, select the check box next to the policy name and then choose Remove.

Updating a role permissions policy (AWS CLI)

To change the permissions allowed by the role, modify the role's permissions policy (or policies). You cannot modify the permissions policy for a service-linked role in IAM. You might be able to modify the permissions policy within the service that depends on the role. To check whether a service supports this feature, see AWS services that work with IAM and look for the services that have Yes in the Service-linked roles column. Choose a Yes with a link to view the service-linked role documentation for that service.

To change the permissions allowed by a role (AWS CLI)

1. (Optional) To view the current permissions associated with a role, run the following commands:

   1. aws iam list-role-policies to list inline policies

   2. aws iam list-attached-role-policies to list managed policies

2. The command to update permissions for the role differs depending on whether you are updating a managed policy or an inline policy.

   To update a managed policy, run the following command to create a new version of the managed policy:

   • aws iam create-policy-version

   To update an inline policy, run the following command:

   • aws iam put-role-policy

Updating a role permissions policy (AWS API)

To change the permissions allowed by the role, modify the role's permissions policy (or policies). You cannot modify the permissions policy for a service-linked role in IAM. You might be able to modify the permissions policy within the service that depends on the role. To check whether a service supports this feature, see AWS services that work with IAM and look for the services that have Yes in the Service-linked roles column. Choose a Yes with a link to view the service-linked role documentation for that service.

To change the permissions allowed by a role (AWS API)

1. (Optional) To view the current permissions associated with a role, call the following operations:

   1. ListRolePolicies to list inline policies

   2. ListAttachedRolePolicies to list managed policies

2. The operation to update permissions for the role differs depending on whether you are updating a managed policy or an inline policy.

   To update a managed policy, call the following operation to create a new version of the managed policy:

   • CreatePolicyVersion

   To update an inline policy, call the following operation:

   • PutRolePolicy

Update the permissions boundary for a role

To change the maximum permissions allowed for a role, modify the role's permissions boundary.

Updating a role permissions boundary (console)

To change the policy used to set the permissions boundary for a role

1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.

2. In the navigation pane, choose Roles.

3. Choose the name of the role with the permissions boundary that you want to change.

4. Choose the Permissions tab. If necessary, open the Permissions boundary section and then choose Change boundary.

5. Select the policy that you want to use for the permissions boundary.

6. Choose Change boundary.

   Your changes don't take effect until the next time someone assumes this role.

Updating a role permissions boundary (AWS CLI)

To change the managed policy used to set the permissions boundary for a role (AWS CLI)

1. (Optional) To view the current permissions boundary for a role, run the following command:

   • aws iam get-role

2. To use a different managed policy to update the permissions boundary for a role, run the following command:

   • aws iam put-role-permissions-boundary

   A role can have only one managed policy set as a permissions boundary. If you change the permissions boundary, you change the maximum permissions allowed for a role.

Updating a role permissions boundary (AWS API)

To change the managed policy used to set the permissions boundary for a role (AWS API)

1. (Optional) To view the current permissions boundary for a role, call the following operation:

   • GetRole

2. To use a different managed policy to update the permissions boundary for a role, call the following operation:

   • PutRolePermissionsBoundary

   A role can have only one managed policy set as a permissions boundary. If you change the permissions boundary, you change the maximum permissions allowed for a role.