Similar to users, roles are also identities. They have an associated set of permissions that allows them to access AWS resources. However, they are not associated with users or groups. Instead, a role can be assumed by other identities and resources such as users in your AWS account, a user in a different AWS account, a federated user, or another AWS service such as EC2. When the role is assumed by one of these methods, the identity will inherit the associated permissions of the role. It’s important to understand that the roles themselves do not have static credentials; instead, they are dynamically created when the role is assumed.
There are a number of different types of roles available, which are as follows:
- Service roles
- User roles
- Web identity federated roles
- SAML 2.0 federated roles
We will discuss each of these roles and learn how to create them in the following subsections.