What s the difference between IAM Roles and policies

Question

What is the difference between IAM Roles and Policies? I know it's probably a stupid doubt but I've recently been introduced to AWS.

Comments

Policies are applied to users and groups that belong to a particular AWS account ▫

Roles are applied to users who are generally not a part of your AWS account ▫

Use roles to delegate access to users, applications, and services that do not have access to your AWS resources

Answer 1

Hi Sonal, IAM roles define the set of permissions for making AWS service request whereas IAM policies define the permissions that you will require.

Its hard to get confused with these two.

For better details, check out the AWS certification.

Comments

Maybe for you it’s hard to get confused.  But for those of us starting out, it’s as clear as mud.

---

....IAM policies define the "permissions" that you will require... do you mean "approvals" or "conditions met"?

---

You can say that. It is basically a user having permissions. IAM roles are like users and policies are like permissions.

Answer 2

IAM Roles are defined as a set of permissions that grant access to actions and resources in AWS. An IAM Role can be used by or assumed by IAM User accounts or by services within AWS, and can give access to Users from another account altogether. IAM Roles are similar to wearing different hats in that they temporarily let an IAM User or a service get permissions to do things they would not normally get to do.  These permissions are attached to the Role itself, and are conveyed to anyone or anything that assumes the role. Also, Roles have credentials that can be used to authenticate the Role identity.

You can assign either a pre-built policy or create a custom policy. A policy is something that will be assigned to a role. Admins of the customer environment create an IAM Policy with a constrained set of access, and then assigns that policy to a new Role, specifically assigned to the provider’s Account ID and External ID.  When done, the resulting IAM Role is given a specific Amazon Resource Name (ARN), which is a unique string that identifies the role.