Which IAM role that grants permissions to an AWS service so it can access AWS resources?

Permissions let you specify access to AWS resources. Permissions are granted to IAM entities (users, groups, and roles) and by default these entities start with no permissions. In other words, IAM entities can do nothing in AWS until you grant them your desired permissions. To give entities permissions, you can attach a policy that specifies the type of access, the actions that can be performed, and the resources on which the actions can be performed. In addition, you can specify any conditions that must be set for access to be allowed or denied.

AWS identity: Next-generation permission management (30:58)

To assign permissions to a user, group, role, or resource, you create a policy that lets you specify:

• Actions – Which AWS service actions you allow. For example, you might allow a user to call the Amazon S3 ListBucket action. Any actions that you don't explicitly allow are denied.
• Resources – Which AWS resources you allow the action on. For example, what Amazon S3 buckets will you allow the user to perform the ListBucket action on? Users cannot access any resources that you do not explicitly grant permissions to.
• Effect – Whether to allow or deny access. Because access is denied by default, you typically write policies where the effect is to allow.
• Conditions – Which conditions must be present for the policy to take effect. For example, you might allow access only to the specific S3 buckets if the user is connecting from a specific IP range or has used multi-factor authentication at login.

You create policies by using either the visual editor or JSON. A policy consists of one or more statements, each of which describes one set of permissions. To learn more about the policy language, see IAM Policy Reference.

The visual editor guides you through granting permissions by using IAM policies without requiring you to write the policies in JSON (although you can still author and edit policies in JSON, if you prefer). The policy in the following screenshot was created with the visual editor. It grants five Amazon S3 List and Read actions to the S3 bucket and objects in SampleBucket if the prefix starts with MyPrefix.

If you use the AWS Management Console to manage permissions, you can view policy summaries. A policy summary lists the access level, resources, and conditions for each service defined in a policy (see the following screenshot for an example). To help you understand the permissions defined in a policy, each AWS service’s actions are categorized in four access levels: List, Read, Write, and Permissions management.

You can select a predefined policy managed by AWS or create your own using the policy generator. For more information, see the Overview of IAM Policies section of the Using IAM guide.

AWS support for Internet Explorer ends on 07/31/2022. Supported browsers are Chrome, Firefox, Edge, and Safari. Learn more »

When third parties require access to your organization's AWS resources, you can use roles to delegate access to them. For example, a third party might provide a service for managing your AWS resources. With IAM roles, you can grant these third parties access to your AWS resources without sharing your AWS security credentials. Instead, the third party can access your AWS resources by assuming a role that you create in your AWS account. To learn whether principals in accounts outside of your zone of trust (trusted organization or account) have access to assume your roles, see What is IAM Access Analyzer?.

Third parties must provide you with the following information for you to create a role that they can assume:

• The third party's AWS account ID. You specify their AWS account ID as the principal when you define the trust policy for the role.

• An external ID to uniquely associate with the role. The external ID can be any secret identifier that is known by you and the third party. For example, you can use an invoice ID between you and the third party, but do not use something that can be guessed, like the name or phone number of the third party. You must specify this ID when you define the trust policy for the role. The third party must provide this ID when they assume the role. For more information about the external ID, see How to use an external ID when granting access to your AWS resources to a third party.

• The permissions that the third party requires to work with your AWS resources. You must specify these permissions when defining the role's permission policy. This policy defines what actions they can take and what resources they can access.

After you create the role, you must provide the role's Amazon Resource Name (ARN) to the third party. They require your role's ARN in order to assume the role.

For details about creating a role to delegate access to a third party, see How to use an external ID when granting access to your AWS resources to a third party.

When you grant third parties access to your AWS resources, they can access any resource that you specify in the policy. Their use of your resources is billed to you. Ensure that you limit their use of your resources appropriately.

How can you access IAM permissions for your AWS resources?

Which of the following is used to grant users access to resources in IAM?

What is the best way to grant permissions to other AWS services?

Which basic permissions allows you to change access permissions on resources?