CODEWITHSUNDEEP
amazon-web-servicesamazon-iam
pkaramol
pkaramol

Reputation: 19312

AWS: Assinging IAM roles to IAM users

According to the offical AWS documentation, IAM Roles can also be attached to IAM Users, and not only services.

What would be a valid use case to assign an IAM Role to an IAM User?

Aren't all the cases covered by directly granting (allow/deny) IAM Policies to the users?

TBH my initial impression was thar IAM Roles served the purpose of authorization for the AWS services (so that they can interact with other services), since the latter cannot be addressed in the User context

Upvotes: 3

Views: 749

Answers (2)

Taterhead
Taterhead

Reputation: 5951

It is an IAM best practice is to assign Roles to AWS users from other AWS accounts in order to delegate permissions. This is to avoid sharing credentials between AWS accounts.

I also wanted to point out, your initial impression about Roles as authorization is not correct. The only IAM resource that is considered authorization are IAM Policies.

This can be seen in the AWS documentation on Understanding IAM and in the following AWS training video: Authentication and Authorization with AWS Identity and Access Management (login required)

The other three basic IAM resources: Users, Groups and Roles are considered part of Authentication.

Upvotes: 1

Ashan
Ashan

Reputation: 19728

As you clearly understood, AWS Roles serves the purpose of authentication (with IAM policies for authorization) for AWS services. In contrast, AWS IAM users directly maps towards human user who obtains credentials to login to the AWS Management Console.

However, when granting access to an User outside the AWS Account (e.g; Cross Account Access, AD Authentication Federation) it will require an IAM Role to Assume the permission.

Referring to the documentation you shared, its not a direct IAM User who is getting permission, rather an Active Directory user (External) assuming an IAM Role (Not direct IAM User) to get access to the AWS Resources.

Upvotes: 5

Related Questions