Home / server / Questions / 1066180
Accepted
spinkus
Asked: 2021-06-10 06:28:10 +0800 CST

AWS IAM Roles: What is a trusted entity exactly?

  • 772

I have a role attached to a LaunchConfiguration for an EC2 instance, that gives the EC2 instance privs to do certain things like do Cloudwatch logs (the context isn't important to the question). In Cloudformation the Role looks like:

    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: 'ec2.amazonaws.com'
          Action: 'sts:AssumeRole'
      Policies: ...

If I view the Role in AWS console, under "Trust relationships" it says "Trusted entities: The identity provider(s) ec2.amazonaws.com":

enter image description here

I assume the Cloudformation AssumeRolePolicyDocument.Principal.Service maps to the "Trusted Entity" in the console (which, as an aside, is a strange way to name things, because I read "Principal" as having a different meaning in IAM, but anyway ... ). I'm straining my brain trying to piece together what is going on. My questions are:

  1. What exactly is an IAM "trusted entity"?
  2. How is it the entity 'ec2.amazonaws.com' "assumes the role"? The concept of the service 'ec2.amazonaws.com' assuming the roll just doesn't click with me.
  3. In what sense is the entity 'ec2.amazonaws.com' is "providing identities"?
  4. Where can I find a full list of these so called trusted entities?
amazon-web-services amazon-iam

1 Answers

  1. Best Answer
    1. A trusted entity is which service can assume any given role. If you make EC2 the trusted entity you can't assume the role to use the permissions, lambda can't assume the role, only an EC2 instance. Most services in AWS are given permissions by assuming roles. Many services can configure this automagically for you, which is common when people are learning AWS. When you're working in secure environments setting up roles and permissions becomes fairly critical. For example, if you give EC2 a role with admin permissions and someone compromises the instance, they effectively have admin rights into your AWS account, which is why you give all resources / roles least permissions.
    2. When you configure a resource like an EC2 instance or Lambda function (etc) you tell it what role to assume. That EC2 instance / function / etc then has the permissions associated with the role.
    3. This just means that an EC2 instance is allowed to assume that role. When an EC2 instance starts it identifies the role it wants to assume. IAM validates the role is allowed to assume that role and the instance is allowed to start.
    4. There's a list of AWS service principals here. When you hit "create role" in the console you get a list in trusted entities. When I need one to put into my CloudFormation I just click that then copy and paste it from the json.

    The AssumeRolePolicyDocument specifies who can assume the role. I suspect you can specify multiple entities can assume a role, but in practice I write a role for each service.

    You can think of IAM roles similar to roles people have. My role as "architect for company XYZ" give me permissions to enter the office, log into the system, that kind of thing. If I assume a role as say a policeman I have additional rights, such as going into a police station, arresting people, etc.

    • 2