What is principal in IAM policy?
Principal. A principal is a person or application that can make a request for an action or operation on an AWS resource. The principal is authenticated as the AWS account root user or an IAM entity to make requests to AWS.
What is an Assume role policy?
sts:AssumeRole. policy and a trust policy attached with the IAM role to allow the IAM user to access the AWS resource using the temporary security credentials. The policy specifies the AWS resource that the IAM user can access and the actions that the IAM user can perform.
What is a role Trust policy?
A role trust policy is a required resource-based policy that is attached to a role in IAM. The principals that you can specify in the trust policy include users, roles, accounts, and services. Permissions policy. A permissions document in JSON format in which you define what actions and resources the role can use.
How does an AssumeRole work?
Returns a set of temporary security credentials that you can use to access AWS resources that you might not normally have access to. These temporary credentials consist of an access key ID, a secret access key, and a security token.
What is a policy principal?
Principal is used by Resource Policies (SNS, S3 Buckets, SQS, etc) to define who the policy applies to. In most cases the Principal is the root user of a specific AWS account. That AWS account can then delegate permission (via IAM) to users or roles.
What is principal in S3 policy?
The Principal element specifies the user, account, service, or other entity that is allowed or denied access to a resource.
What is action STS AssumeRole?
The sts:AssumeRole action is the means by which such temporary credentials are obtained. To use it, a user or application calls this API using some already-obtained credentials, such as a user’s fixed access key, and it returns (if permitted) a new set of credentials to act as the role.
What is Assume role policy in terraform?
An assume role policy is a special policy associated with a role that controls which principals (users, other roles, AWS services, etc) can “assume” the role. Assuming a role means generating temporary credentials to act with the privileges granted by the access policies associated with that role.
What is the difference between IAM roles and policies?
Hi Sonal, IAM roles define the set of permissions for making AWS service request whereas IAM policies define the permissions that you will require. IAM roles are like users and policies are like permissions.
How do I add a trust policy to an IAM role?
In the navigation pane of the IAM console, choose Roles. The console displays the roles for your account. Choose the name of the role that you want to modify, and select the Trust relationships tab on the details page. Choose Edit trust relationship.
How does EC2 assume role?
An administrator creates the Get-pics service role and attaches the role to the EC2 instance. The role includes a permissions policy that grants read-only access to the specified S3 bucket. It also includes a trust policy that allows the EC2 instance to assume the role and retrieve the temporary credentials.
What is STS :: AssumeRole?