Contents
What is AssumeRolePolicyDocument?
AssumeRolePolicyDocument. The trust policy that is associated with this role. Trust policies define which entities can assume the role. You can associate only one trust policy with a role. For an example of a policy that can be used to assume a role, see Template Examples.
What is principal in AWS IAM role?
Principal. A principal is a person or application that can make a request for an action or operation on an AWS resource. The principal is authenticated as the AWS account root user or an IAM entity to make requests to AWS. As a best practice, do not use your root user credentials for your daily work.
What is a trust relationship IAM?
Trust relationship – This policy defines which principals can assume the role, and under which conditions. This is sometimes referred to as a resource-based policy for the IAM role.
What is assume role in IAM?
PDF. Returns a set of temporary security credentials that you can use to access AWS resources that you might not normally have access to. These temporary credentials consist of an access key ID, a secret access key, and a security token.
What role does CloudFormation use?
A service role is an AWS Identity and Access Management (IAM) role that allows AWS CloudFormation to make calls to resources in a stack on your behalf. You can specify an IAM role that allows AWS CloudFormation to create, update, or delete your stack resources.
Is IAM role name unique?
Each IAM user name is unique and case-insensitive.
How do you build trust in a relationship?
The console displays the roles for your account. Choose the name of the role that you want to modify, and select the Trust relationships tab on the details page. Choose Edit trust relationship. Under Policy Document, paste the following, and then choose Update Trust Policy.
What is a trust policy?
1. Set of rules, expressed in a formal way, used to make trust decisions.
Can IAM user assume a role?
Create the IAM role and attach the policy Because this IAM role is assumed by an IAM user, you must specify a principal that allows IAM users to assume that role. For example, a principal similar to arn:aws:iam::123456789012:root allows all IAM identities of the account to assume that role.
What’s the correct way to go about the assumerolepolicydocument field?
What’s the correct way to go about the AssumeRolePolicyDocument field for roles that are designed for users, not resources? You can specify an AWS IAM user using the AWS key instead of Service as the Principal for a role policy document, including an AssumeRolePolicyDocument:
How does Inline Policy work in IAM role?
Adds or updates an inline policy document that is embedded in the specified IAM role. When you embed an inline policy in a role, the inline policy is used as part of the role’s access (permissions) policy. The role’s trust policy is created at the same time as the role.
What’s the purpose of assumerolepolicolicydocument in Amazon Web Services?
AssumeRolePolicyDocument is a restriction placed by the user that creates the role – e.g. possibly an admin. It prevents other users from attaching it to any AWS service / user they like. Also, it tells nothing about where it’s actually used. It’s a protection on the Role-side (treating Role as a resource that should also be protected).
What does assumerolepolicydocument mean in AWS YAML?
AssumeRolePolicyDocument (in CloudFormation yaml) = Trust Relationships (in AWS Console web GUI) I think it’s much clearer when considering the user that creates a role isn’t necessarily the one attaching it for use somewhere: