Using an IAM Role to Grant Permissions to Applications and Scripts Running on AppStream 2.0 Streaming Instances
Applications and scripts that run on AppStream 2.0 streaming instances must include AWS credentials in their AWS API requests. You can create an IAM role to manage these credentials. An IAM role specifies a set of permissions that you can use to access AWS resources. This role is not uniquely associated with one person, however. Instead, it can be assumed by anyone that needs it.
You can apply an IAM role to an AppStream 2.0 streaming instance. When the streaming instance switches to (assumes) the role, the role provides temporary security credentials. Your application or scripts use these credentials to perform API actions and management tasks on the streaming instance. AppStream 2.0 manages the temporary credential switch for you.