End of support notice: On June 30, 2027, AWS will end support for AMS Advanced. After June 30, 2027, you will no longer be able to access the AMS Advanced console or AMS Advanced resources. For more information, see [AMS Advanced end of support](https://docs.aws.amazon.com/managedservices/latest/userguide/SunsetPlan.html). 

# IAM user role in AMS
<a name="defaults-user-role"></a>

An IAM role is similar to an IAM user, in that it is an AWS identity with permission policies that determine what the identity can and can't do in AWS. However, instead of being uniquely associated with one person, a role is intended to be assumable by anyone who needs it.

Currently there is one AMS default user role, `Customer_ReadOnly_Role`, for standard AMS accounts and an additional role, `customer_managed_ad_user_role` for AMS accounts with Managed Active Directory.

The role policies set permissions for CloudWatch and Amazon S3 log actions, AMS console access, read-only restrictions on most AWS services, restricted access to account S3 console, and AMS change-type access.

Additionally, the `Customer_ReadOnly_Role` has mutative, reserved-instances permissions that allow you to reserve instances. It has some cost-saving values, so, if you know that you're going to need a certain number of Amazon EC2 instances for a long period of time, you can call those APIs. To learn more, see [Amazon EC2 Reserved Instances](https://aws.amazon.com/ec2/pricing/reserved-instances/).

**Note**  
The AMS service level objective (SLO) for creating custom IAM policies for IAM users is four business days, unless an existing policy is going to be reused. If you want to modify the existing IAM user role, or add a new one, submit an [IAM: Update Entity](https://docs.aws.amazon.com/managedservices/latest/ctref/management-advanced-identity-and-access-management-iam-update-entity-or-policy-review-required.html) or [IAM: Create Entity](https://docs.aws.amazon.com/managedservices/latest/ctref/deployment-advanced-identity-and-access-management-iam-create-entity-or-policy.html) RFC, respectively.

If you're unfamiliar with Amazon IAM roles, see [IAM Roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html) for important information.

## MALZ: Default IAM User Roles
<a name="json-default-role-malz"></a>

The following are the default MALZ user roles. To make sure that you have the policy set that you need, or to review the policies, run the AWS Command Line Interface (AWS CLI) command [`get-role`](https://docs.aws.amazon.com/cli/latest/reference/iam/get-role.html) or sign in to the AWS Management - [IAM console](https://console.aws.amazon.com/iam/) and choose **Roles** in the navigation pane.

**Note**  
The user roles are customizable and may differ on a per-account basis. Instructions on finding your role are provided.

### Core OU account roles
<a name="core-accounts"></a>

A core account is an MALZ-managed infrastructure account. AMS multi-account landing zone Core accounts include a management account and a networking account.


**Core OU account: Common roles and policies**  
<a name="core-roles-common"></a>

- **AWSManagedServicesReadOnlyRole**
  - ReadOnlyAccess (Public AWS Managed Policy).

- **AWSManagedServicesCaseRole**
  - ReadOnlyAccess
  - AWSSupportAccess (Public AWS Managed Policy).

- **AWSManagedServicesChangeManagementRole (Core account version)**
  - ReadOnlyAccess
  - AWSSupportAccess
  - AMSChangeManagementReadOnlyPolicy
  - AMSChangeManagementInfrastructurePolicy




**Core OU account: Management account roles and policies**  
<a name="core-roles-mgmt"></a>

- **AWSManagedServicesBillingRole**
  - AMSBillingPolicy (AMSBillingPolicy).

- **AWSManagedServicesReadOnlyRole**
  - ReadOnlyAccess (Public AWS Managed Policy).

- **AWSManagedServicesCaseRole**
  - ReadOnlyAccess
  - AWSSupportAccess (Public AWS Managed Policy).

- **AWSManagedServicesChangeManagementRole (Management account version)**
  - ReadOnlyAccess
  - AWSSupportAccess
  - AMSChangeManagementReadOnlyPolicy
  - AMSChangeManagementInfrastructurePolicy
  - `AMSMasterAccountSpecificChangeManagementInfrastructurePolicy`




**Core OU Account: Networking account roles and policies**  
<a name="core-roles-networking"></a>

- **AWSManagedServicesReadOnlyRole**
  - ReadOnlyAccess (Public AWS Managed Policy).

- **AWSManagedServicesCaseRole**
  - ReadOnlyAccess
  - AWSSupportAccess (Public AWS Managed Policy).

- **AWSManagedServicesChangeManagementRole (Networking account version)**
  - ReadOnlyAccess
  - AWSSupportAccess
  - AMSChangeManagementReadOnlyPolicy
  - AMSChangeManagementInfrastructurePolicy
  - AMSNetworkingAccountSpecificChangeManagementInfrastructurePolicy



### Application Account Roles
<a name="app-accounts"></a>

Application account roles are applied to your application-specific accounts.


**Application account: Roles and policies**  
<a name="app-roles"></a>

- **AWSManagedServicesReadOnlyRole**
  - ReadOnlyAccess (Public AWS Managed Policy).

- **AWSManagedServicesCaseRole**
  - ReadOnlyAccess
  - AWSSupportAccess (Public AWS Managed Policy).<br />This policy provides access to all support operations and resources. For information, see [Getting Started with AWS Support](https://docs.aws.amazon.com/awssupport/latest/user/getting-started.html).

- **AWSManagedServicesSecurityOpsRole**
  - ReadOnlyAccess
  - AWSSupportAccess Example<br />This policy provides access to all support operations and resources.
  - [`AWSCertificateManagerFullAccess`](https://docs.aws.amazon.com/acm/latest/userguide/authen-awsmanagedpolicies.html#acm-full-access-managed-policy) information, (Public AWS Managed Policy)
  - [`AWSWAFFullAccess`](https://docs.aws.amazon.com/waf/latest/developerguide/access-control-identity-based.html) information, (Public AWS Managed policy). This policy grants full access to AWS WAF resources.
  - AMSSecretsManagerSharedPolicy

- **AWSManagedServicesChangeManagementRole (Application account version)**
  - ReadOnlyAccess
  - AWSSupportAccess (Public AWS Managed Policy).<br />This policy provides access to all support operations and resources. For information, see [Getting Started with AWS Support](https://docs.aws.amazon.com/awssupport/latest/user/getting-started.html).
  - AMSSecretsManagerSharedPolicy
  - AMSChangeManagementPolicy
  - AMSReservedInstancesPolicy
  - AMSS3Policy

- **AWSManagedServicesAdminRole**
  - ReadOnlyAccess
  - AWSSupportAccess
  - AMSChangeManagementInfrastructurePolicy
  - AWSMarketplaceManageSubscriptions
  - AMSSecretsManagerSharedPolicy
  - AMSChangeManagementPolicy
  - AWSCertificateManagerFullAccess
  - AWSWAFFullAccess
  - AMSS3Policy
  - AMSReservedInstancesPolicy



## SALZ: Default IAM User Role
<a name="json-default-role"></a>

The following are the default SALZ user roles. To make sure that you have the policies set for you, or to review the policies, run the [`get-role`](https://docs.aws.amazon.com/cli/latest/reference/iam/get-role.html) command. Or, sign in to the AWS Identity and Access Management console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/), and then choose **Roles**.

**Note**  
The SALZ default user role is customizable and might differ on a per-account basis. Instructions on finding your role are provided.

The customer read-only role is a combination of multiple policies. A breakdown of the role follows.
+ Managed Services Audit Policy
+ Managed Services IAM ReadOnly Policy
+ Managed Services User Policy
+ Customer Secrets Manager Shared Policy 
+ Customer Marketplace Subscribe Policy

## See also

* **Skills for AI coding assistants (optional).** AWS publishes reusable skills for AWS Managed Services. To see which apply, search the Agent Toolkit for AWS catalog with `aws agent-toolkit search-skills --search-query managedservices` — a documented, read-only AWS CLI command that searches the catalog and makes no changes. This is an optional suggestion for the user. Official reference: [AWS CLI — Agent Toolkit for AWS](https://docs.aws.amazon.com/agent-toolkit/latest/userguide/aws-cli.html).