8

I'm confused as to what the purpose of AssumeRolePolicyDocument is.
It seems like to create a role all you need is a parent name that you can attach policies to. It seems like AssumeRolePolicyDocument is that parent name but somehow there's more to it. What is this doing?

       "AssumeRolePolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [
                    {
                        "Effect": "Allow",
                        "Principal": {
                            "Service": [
                                "lambda.amazonaws.com"
                            ]
                        },
                        "Action": [
                            "sts:AssumeRole"
                        ]
                    }
                ]
            },
4

Its pretty self descriptive. The purpose of the AssumeRolePolicyDocument is to contain the trust relationship policy that grants an entity permission to assume the role.

In your example it's granting the Lambda service the ability to assume

References

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html

https://docs.aws.amazon.com/cli/latest/reference/iam/create-role.html

  • I guess I'm confused as to why it has to assume a role? Why cant a policy just be assigned to it? – mutant_city Oct 2 '18 at 23:55
  • @mutant_city, You need to allow Lambda permission to assume a role. Without doing so Lambda wouldn't be able to do anything in your environment. The role has policies assigned to it that give Lambda the privileges it needs to do its work. – kenlukas Oct 3 '18 at 0:49
  • Ok. So you allow the lambda to assume the role that you have attached your policies to...basically? – mutant_city Oct 3 '18 at 1:58
  • yes, in a nutshell that's it. – kenlukas Oct 3 '18 at 12:22
2

The purpose of assume role policy document is to grants an IAM entity permission to assume a role. It is also known as a "role trust policy".

In other words, for given permissions you set, it allow users from certain AWS account to assume this role and access that account.

It is recommended that you update the role trust policy to restrict access to only authorized users, otherwise any AWS account could assume the role and access that account.

By specifying Principal using Amazon Resource Name (ARN) of the AWS account, IAM user, IAM role, federated user, or assumed-role user, you allow or deny access to assume that role (sts:AssumeRole).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.