# LazyRoleProps

Properties for defining a LazyRole.

Extends: LazyRoleProps
Extends: RoleProps
Used as props by: LazyRole

- Source: [`aws-iam/lib/lazy-role.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-iam/lib/lazy-role.ts#L17)

## Example

```ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import * as cdk from 'aws-cdk-lib';
import { aws_iam as iam } from 'aws-cdk-lib';

declare const managedPolicy: iam.ManagedPolicy;
declare const policyDocument: iam.PolicyDocument;
declare const principal: iam.IPrincipal;
const lazyRoleProps: iam.LazyRoleProps = {
  assumedBy: principal,

  // the properties below are optional
  description: 'description',
  externalIds: ['externalIds'],
  inlinePolicies: {
    inlinePoliciesKey: policyDocument,
  },
  managedPolicies: [managedPolicy],
  maxSessionDuration: cdk.Duration.minutes(30),
  path: 'path',
  permissionsBoundary: managedPolicy,
  roleName: 'roleName',
};
```

## Properties

- `assumedBy`: [IPrincipal](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IPrincipal.html) (required) — The IAM principal (i.e. `new ServicePrincipal('sns.amazonaws.com')`) which can assume this role.

  You can later modify the assume role policy document by accessing it via
  the `assumeRolePolicy` property.

- `description`: string — A description of the role.

  **Default:** No description.

  It can be up to 1000 characters long.

- `externalIds`: string[] — List of IDs that the role assumer needs to provide one of when assuming this role.

  **Default:** No external ID required

  If the configured and provided external IDs do not match, the
  AssumeRole operation will fail.

- `inlinePolicies`: { [key: string]: [PolicyDocument](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.PolicyDocument.html) } — A list of named policies to inline into this role.

  **Default:** No policy is inlined in the Role resource.

  These policies will be
  created with the role, whereas those added by ``addToPolicy`` are added
  using a separate CloudFormation resource (allowing a way around circular
  dependencies that could otherwise be introduced).

- `managedPolicies`: [IManagedPolicy](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IManagedPolicy.html)[] — A list of managed policies associated with this role.

  **Default:** No managed policies.

  You can add managed policies later using
  `addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName(policyName))`.

- `maxSessionDuration`: [Duration](/cdk/api/v2/docs/aws-cdk-lib.Duration.html) = Duration.hours(1) — The maximum session duration that you want to set for the specified role.

  This setting can have a value from 1 hour (3600sec) to 12 (43200sec) hours.

  Anyone who assumes the role from the AWS CLI or API can use the
  DurationSeconds API parameter or the duration-seconds CLI parameter to
  request a longer session. The MaxSessionDuration setting determines the
  maximum duration that can be requested using the DurationSeconds
  parameter.

  If users don't specify a value for the DurationSeconds parameter, their
  security credentials are valid for one hour by default. This applies when
  you use the AssumeRole* API operations or the assume-role* CLI operations
  but does not apply when you use those operations to create a console URL.

- `path`: string = / — The path associated with this role.

  For information about IAM paths, see
  Friendly Names and Paths in IAM User Guide.

- `permissionsBoundary`: [IManagedPolicy](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IManagedPolicy.html) — AWS supports permissions boundaries for IAM entities (users or roles).

  **Default:** No permissions boundary.

  A permissions boundary is an advanced feature for using a managed policy
  to set the maximum permissions that an identity-based policy can grant to
  an IAM entity. An entity's permissions boundary allows it to perform only
  the actions that are allowed by both its identity-based policies and its
  permissions boundaries.

- `roleName`: string — A name for the IAM role.

  **Default:** AWS CloudFormation generates a unique physical ID and uses that ID for the role name.

  For valid values, see the RoleName parameter for
  the CreateRole action in the IAM API Reference.

  IMPORTANT: If you specify a name, you cannot perform updates that require
  replacement of this resource. You can perform updates that require no or
  some interruption. If you must replace the resource, specify a new name.

  If you specify a name, you must specify the CAPABILITY_NAMED_IAM value to
  acknowledge your template's capabilities. For more information, see
  Acknowledging IAM Resources in AWS CloudFormation Templates.