AWS IAM Role Manager Streamlines Identity and Access Management Setup
AWS has launched IAM Role Manager, automating the creation and configuration of IAM roles directly within supported service consoles. This new capability significantly reduces manual setup and context-switching, accelerating application development and proof-of-concept deployment for developers and engineers. It provisions roles for common service integrations and custom code, initially using `PowerUserAccess` for the latter, while retaining full user control. Users can refine these permissions for least privilege as workloads mature, integrating with IAM Access Analyzer.
- →Automates IAM Role Creation and Configuration
- →Simplifies Initial Setup for Common AWS Service Integrations
- →Provides Execution Roles for Custom Code with Broad Initial Access
- →Maintains Full User Control and Supports Least-Privilege Refinement
- →Enabled via Account Settings in IAM Console
Features (1) ›
- Automates IAM Role Creation and Configuration
IAM Role Manager automatically creates and attaches necessary IAM roles as users build resources in supported AWS service consoles. This eliminates the manual setup and context-switching traditionally required for defining permissions, allowing developers to focus on application logic.
Enhancements (2) ›
- Simplifies Initial Setup for Common AWS Service Integrations
For common tasks like configuring an Amazon EventBridge rule to invoke a target, Role Manager provisions the required role and permissions automatically. Users can complete resource creation without pausing to set up IAM roles separately, integrating the process into the service console flow.
- Provides Execution Roles for Custom Code with Broad Initial Access
When creating resources for custom code, such as AWS Lambda functions, Role Manager attaches an execution role with the `PowerUserAccess` managed policy. This enables immediate code execution, with the understanding that permissions can be narrowed once the function's dependencies are known.
Maintenance (1) ›
- Enabled via Account Settings in IAM Console
IAM Role Manager is an account-level control, activated with a single switch in the IAM console's Account settings. AWS Organizations administrators can use Service Control Policies (SCPs) to govern whether member accounts can enable or utilize this feature.
Notes (1) ›
- Maintains Full User Control and Supports Least-Privilege Refinement
All roles created by Role Manager are standard IAM roles, fully visible, editable, and deletable by the user. Integration with IAM Access Analyzer provides unused access analysis, offering recommendations to refine permissions to a least-privilege model as workloads mature.
https://aws.amazon.com/blogs/security/how-aws-iam-role-manager-rethinks-the-starting-point-for-iam-roles/
Related releases
- AWS IAM Role Manager Automates Service Role Setup AWS What's New ·
- Terraform AWS Provider v6.59.0 Adds New Data Sources and Resources Terraform AWS Provider Releases ·
- AWS IAM simplifies role assignment for workforce users with account access manager AWS What's New ·
- Amazon Bedrock expands IAM principal cost allocation for mantle endpoint AWS What's New ·
- AWS Blog: Unified Access Control for Enterprise Lakehouses AWS Big Data Blog ·
- AWS Glue integrates with SageMaker Unified Studio for one-click data access AWS What's New ·