AWS Certified Cloud Practitioner / Identity and Access Management

IAM Roles for AWS Services

🎭 IAM Roles

This is the last piece of IAM: Roles.

Why they exist: as you use AWS, you'll spin up services that need to act on your behalf inside your account — reading data, calling other APIs, talking to other services. Just like a person, a service can't do any of that without permission.

What a Role actually is: think of it as a user account, but built for a service instead of a person. It's a set of permissions a service can "assume" when it needs them, rather than something someone logs into directly.

That idea takes a moment to click — so let's walk through an example.

💻 Example with EC2 Instance

Let’s say you create an EC2 instance (a virtual server).

Now imagine:

  • This EC2 instance needs to interact with AWS

  • For example, accessing another service

  • By default, The EC2 instance has no permissions

🔗 Connecting EC2 with an IAM Role

To give it permissions:

  1. You create an IAM Role

  2. You assign permissions to that role

  3. You attach the role to the EC2 instance

👉 Now they work together as one unit

⚙️ How It Works in Practice

Whenever the EC2 instance needs to access AWS resources or make API calls, it goes through its IAM Role to do so.

  • ✅ Role has the right permissions → access granted

  • ❌ It doesn't → access denied

🔁 Common IAM Role Use Cases

IAM Roles are widely used across AWS services.

Some common examples include:

  • 💻 EC2 Instance Roles

  • ⚡ Lambda Function Roles

  • 🏗️ CloudFormation Roles

👉 Any AWS service that needs to act on your behalf will use a role