World map

 

BM

World A2: Keys & Guards

Roles for services

You will learn: how a server or service borrows a role, so no key is ever stored on it.

Checked with AWS 2026-11 on 1 Nov 2026

The problem

Kedai Kancil’s web server must read the menu bucket. How should the server get its key?

Watch

A role for a service is a service role: A role that an AWS service borrows to do work for you, like a server reading the menu.. Put the steps in order.

First step at the top. Put these in order. Use the arrows, or drag.

  • The keys renew by themselves
  • Give the role a small permissions policy
  • Make a role the EC2 service may borrow
  • The app asks the server for short-lived keys
  • Attach the role to the server

Watch

Every role has two notes. The trust policy: The note on a role that says who may borrow it: a service, a user, or GitHub Actions. says who may borrow it. The permissions policy says what it opens. Sort them.

Drag a card into a box. Or tap the card, then tap the box.

      Try it

      Attach the menu-reader policy to the role kedai-web. Build the command.

      Tap the pieces in the right order.

      …

      Watch

      bash
      aws iam list-attached-role-policies --role-name SecurityAuditRole
      {
      "AttachedPolicies": [
      {
      "PolicyName": "SecurityAudit",
      "PolicyArn": "arn:aws:iam::aws:policy/SecurityAudit"
      }
      ],
      "IsTruncated": false
      }

      Ask a role what it holds. This one holds one AWS policy, SecurityAudit. Check after every change.

      Predict

      The server, wearing its role, tries to change the menu. Predict.

      Read the request and its policies. Will AWS say Allow or Deny?

      The request

      Who
      kedai-web server (role session)arn:aws:sts::111122223333:assumed-role/kedai-web/i-0123456789abcdef0
      Wants to
      s3:PutObject
      On
      arn:aws:s3:::kedai-menu/today.json
      Identity policy (key ring) · menu-reader
      {
      "Version": "2012-10-17",
      "Statement": [
      {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::kedai-menu/*"
      }
      ]
      }
      Your guess:

      You did it!

      You can now give a server a role instead of a stored key.

      Go deeper (optional)

      On EC2, the role rides in an “instance profile”. Most AWS SDKs and the CLI find the role’s keys by themselves. Some services make their own service-linked roles.

      Real rep: only with a budget alarm set. Make a role, attach a policy, then list it. Delete both when done (aws iam detach-role-policy, then aws iam delete-role).