aws AWS Security Blog ·

AWS IAM Role Manager Streamlines Identity and Access Management Setup

blogsecurityawsgaengineeraws-iam
feature announcement

AWS has launched IAM Role Manager, automating the creation and configuration of IAM roles directly within supported service consoles. This new capability significantly reduces manual setup and context-switching, accelerating application development and proof-of-concept deployment for developers and engineers. It provisions roles for common service integrations and custom code, initially using `PowerUserAccess` for the latter, while retaining full user control. Users can refine these permissions for least privilege as workloads mature, integrating with IAM Access Analyzer.

  • Automates IAM Role Creation and Configuration
  • Simplifies Initial Setup for Common AWS Service Integrations
  • Provides Execution Roles for Custom Code with Broad Initial Access
  • Maintains Full User Control and Supports Least-Privilege Refinement
  • Enabled via Account Settings in IAM Console
Features (1)
  • Automates IAM Role Creation and Configuration

    IAM Role Manager automatically creates and attaches necessary IAM roles as users build resources in supported AWS service consoles. This eliminates the manual setup and context-switching traditionally required for defining permissions, allowing developers to focus on application logic.

Enhancements (2)
  • Simplifies Initial Setup for Common AWS Service Integrations

    For common tasks like configuring an Amazon EventBridge rule to invoke a target, Role Manager provisions the required role and permissions automatically. Users can complete resource creation without pausing to set up IAM roles separately, integrating the process into the service console flow.

  • Provides Execution Roles for Custom Code with Broad Initial Access

    When creating resources for custom code, such as AWS Lambda functions, Role Manager attaches an execution role with the `PowerUserAccess` managed policy. This enables immediate code execution, with the understanding that permissions can be narrowed once the function's dependencies are known.

Maintenance (1)
  • Enabled via Account Settings in IAM Console

    IAM Role Manager is an account-level control, activated with a single switch in the IAM console's Account settings. AWS Organizations administrators can use Service Control Policies (SCPs) to govern whether member accounts can enable or utilize this feature.

Notes (1)
  • Maintains Full User Control and Supports Least-Privilege Refinement

    All roles created by Role Manager are standard IAM roles, fully visible, editable, and deletable by the user. Integration with IAM Access Analyzer provides unused access analysis, offering recommendations to refine permissions to a least-privilege model as workloads mature.

Read the original announcement →

https://aws.amazon.com/blogs/security/how-aws-iam-role-manager-rethinks-the-starting-point-for-iam-roles/

Related releases