Let's quickly go through some important details about IAM roles:
- The trust policy for a role allows a user in the trusted account to switch to or assume that role.
- A wildcard (*) cannot be specified as a principal for a trust policy.
- When a user assumes a role, it temporarily gives up its own permissions until the user stops using the role.
- Some services allow attaching a policy directly to a resource without needing to use a role as a proxy. These resources include S3 buckets, Glacier vaults, Amazon simple notification service (SNS) topics, and Amazon simple queue service (SQS) queues.
- Roles can be used by the external users authenticated by an external identity provider service to get access to AWS resources. Roles allow ...