Lesson 06 — IAM Roles

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 02 – Identity & Access Management (IAM)

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand what IAM Roles are.
Explain how IAM Roles differ from IAM Users.
Understand Trust Relationships.
Learn how AWS services assume Roles.
Create and manage IAM Roles.
Assign Roles to EC2 instances.
Understand enterprise Role design.
Apply IAM Roles using AWS CLI.

📚 Lesson Information

Estimated Time: 4–5 Hours

Difficulty: Beginner

Prerequisites: Lesson 05 – IAM Policies

Hands-on Lab: Yes

Assignment: Yes

💼 Business Value

One of the biggest security mistakes in cloud environments is storing long-term AWS Access Keys inside applications or virtual machines.

Imagine an EC2 server running your company’s production web application.

If the application stores AWS credentials inside configuration files and an attacker compromises the server, those credentials can be stolen and used to access your AWS environment.

Instead, AWS recommends using IAM Roles, which provide temporary credentials that are automatically rotated.

IAM Roles eliminate the need to store long-term secrets and significantly improve cloud security.

🏢 In the Company

CloudNova Technologies has deployed several AWS workloads:

Customer Web Application
Internal HR Portal
AI Data Processing Platform
Backup Automation
Security Monitoring System

Developers have embedded AWS Access Keys directly into application code.

The Chief Information Security Officer (CISO) immediately raises a critical issue:

“No application should ever contain long-term AWS credentials. Replace them with IAM Roles immediately.”

Your task is to redesign the authentication model using IAM Roles.

🌍 What is an IAM Role?

An IAM Role is an AWS identity that provides temporary security credentials.

Unlike IAM Users, Roles:

Do not have passwords.
Do not have permanent Access Keys.
Are assumed when required.
Automatically issue temporary credentials.
Expire after a defined session.

IAM Roles are the recommended way for AWS services and applications to access AWS resources securely.

👤 IAM Users vs IAM Roles

IAM User	IAM Role
Permanent identity	Temporary identity
Username	No username
Password	No password
Long-term Access Keys	Temporary credentials
Used by people	Used by people, applications and AWS services
Credentials require manual rotation	Credentials rotate automatically

🔐 Why Enterprises Prefer IAM Roles

IAM Roles provide several security benefits:

No hardcoded credentials.
Automatic credential rotation.
Reduced risk of credential theft.
Simplified access management.
Easier auditing.
Supports cross-account access.
Supports temporary administrative access.

This is why IAM Roles are used extensively in enterprise cloud environments.

🏗 IAM Role Architecture

Application

        │

        ▼

IAM Role

        │

        ▼

Temporary Credentials

        │

        ▼

AWS Resource

The application never stores permanent credentials.

🔑 Trust Relationships

Before a Role can be used, AWS must know who is allowed to assume it.

This is defined in the Trust Policy.

Example:

EC2 Instance

↓

Allowed

↓

Assume Role

↓

EC2-WebServer-Role

Only trusted entities can assume a Role.

🏢 Common Types of IAM Roles

AWS environments commonly use the following Roles:

Role	Purpose
EC2 Role	Access AWS resources from EC2
Lambda Execution Role	Access AWS services from Lambda
ECS Task Role	Containers access AWS services
EKS IAM Role	Kubernetes workloads
CloudFormation Role	Infrastructure deployment
Cross-Account Role	Multi-account administration
ReadOnly Audit Role	Auditors

🏢 CloudNova Enterprise Roles

CloudNova designs the following enterprise Roles.

Role	Purpose
EC2-WebServer-Role	Read objects from S3
EC2-Backup-Role	Access AWS Backup
Lambda-Notification-Role	Publish SNS notifications
Security-Audit-Role	Read CloudTrail logs
CloudEngineer-Admin-Role	Temporary administration
CrossAccount-Security-Role	Manage multiple AWS accounts

These Roles will be expanded throughout the AWS Security learning path.

🚫 Common Mistakes

Avoid the following:

❌ Hardcoding Access Keys into applications.

❌ Assigning AdministratorAccess to EC2 instances.

❌ Using Root credentials.

❌ Sharing IAM Users between applications.

❌ Creating one Role per EC2 instance without planning.

✅ Best Practices

Prefer IAM Roles over Access Keys.
Grant only required permissions.
Use descriptive naming conventions.
Separate application Roles from administrator Roles.
Review Trust Policies regularly.
Monitor Role usage using CloudTrail.
Apply Least Privilege.

🧪 Enterprise Mission 01 — Explore Existing Roles

Open the AWS Console.

Navigate to:

IAM

↓

Roles

Review:

Role Name
Trusted Entity
Attached Policies
Last Activity

Questions:

How many Roles exist?
Which AWS services use Roles?

🧪 Enterprise Mission 02 — List IAM Roles

Open PowerShell.

Run:

aws iam list-roles

Review:

Role Names
Role ARN
Creation Date

🧪 Enterprise Mission 03 — View Role Details

Retrieve information about a Role.

aws iam get-role \
--role-name ROLE_NAME

Replace:

ROLE_NAME

with an existing Role.

Review:

ARN
Trust Policy
Creation Date

🧪 Enterprise Mission 04 — Create a Trust Policy

Create a file named:

EC2TrustPolicy.json

Add the following content:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "ec2.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

This policy allows Amazon EC2 to assume the Role.

🧪 Enterprise Mission 05 — Create an IAM Role

Create the Role.

aws iam create-role \
--role-name EC2-WebServer-Role \
--assume-role-policy-document file://EC2TrustPolicy.json

Verify.

aws iam list-roles

🧪 Enterprise Mission 06 — Attach a Policy

Attach an AWS Managed Policy.

aws iam attach-role-policy \
--role-name EC2-WebServer-Role \
--policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

Verify.

aws iam list-attached-role-policies \
--role-name EC2-WebServer-Role

🧪 Enterprise Mission 07 — Create an EC2 Instance Profile

IAM Roles are attached to EC2 instances using an Instance Profile.

Create one.

aws iam create-instance-profile \
--instance-profile-name EC2-WebServer-Profile

Add the Role.

aws iam add-role-to-instance-profile \
--instance-profile-name EC2-WebServer-Profile \
--role-name EC2-WebServer-Role

Verify.

aws iam get-instance-profile \
--instance-profile-name EC2-WebServer-Profile

🧪 Enterprise Mission 08 — Attach Role to an EC2 Instance

Using the AWS Console:

Navigate to:

EC2

↓

Instances

↓

Actions

↓

Security

↓

Modify IAM Role

Attach:

EC2-WebServer-Role

🧪 Enterprise Mission 09 — Verify Temporary Credentials

Connect to the EC2 instance using AWS Systems Manager Session Manager or SSH.

Run:

curl http://169.254.169.254/latest/meta-data/iam/security-credentials/

This retrieves the IAM Role attached to the instance.

Then retrieve the temporary credentials:

curl http://169.254.169.254/latest/meta-data/iam/security-credentials/EC2-WebServer-Role

Observe:

AccessKeyId
SecretAccessKey
SessionToken
Expiration

Notice that the credentials are temporary and expire automatically.

🧪 Enterprise Mission 10 — Cross-Account Scenario

CloudNova has created a second AWS account for Production.

The Security Team must investigate incidents in both Development and Production accounts.

Questions:

Should separate IAM Users be created in every account?
Or should a Cross-Account IAM Role be used?

Write your recommendation.

🏢 Enterprise Scenario

CloudNova’s developers have committed AWS Access Keys to a public Git repository.

A security incident is declared.

Your recommendations should include:

Immediate containment.
Credential rotation.
Migration to IAM Roles.
CloudTrail review.
IAM Access Analyzer review.
Security awareness training.

📊 Knowledge Check

What is an IAM Role?
How does an IAM Role differ from an IAM User?
Why are IAM Roles more secure than Access Keys?
What is a Trust Policy?
What is sts:AssumeRole?
Which AWS services commonly use IAM Roles?
What is an Instance Profile?
Why are temporary credentials preferred?
Which AWS CLI command creates a Role?
Which CLI command attaches a policy to a Role?

📝 Assignment

Prepare an Enterprise IAM Role Design Guide.

Include:

IAM Role Overview
IAM Users vs IAM Roles
Trust Relationships
Enterprise Role Architecture
EC2 Role Example
AWS CLI Commands Used
Screenshots
Lessons Learned

Length:

5–6 Pages

📋 Lesson Completion Checklist

Task	Status
Reviewed Existing Roles	☐
Listed IAM Roles	☐
Viewed Role Details	☐
Created Trust Policy	☐
Created IAM Role	☐
Attached Policy	☐
Created Instance Profile	☐
Attached Role to EC2	☐
Verified Temporary Credentials	☐
Completed Assignment	☐

💡 Key Takeaways

After completing this lesson, you should understand:

IAM Roles provide temporary credentials and eliminate the need for long-term Access Keys.
Trust Policies determine which users, services or accounts are allowed to assume a Role.
AWS services such as EC2, Lambda and ECS rely on IAM Roles to securely access AWS resources.
Instance Profiles are required to attach IAM Roles to EC2 instances.
Enterprise environments use IAM Roles extensively to improve security, simplify credential management and support least privilege.

📚 Further Reading

AWS IAM Roles User Guide
AWS STS Documentation
AWS IAM Best Practices
AWS Well-Architected Framework – Security Pillar
AWS EC2 Instance Metadata Service (IMDSv2)

🚀 Next Lesson

➡️ Lesson 07 — Policy Evaluation Logic