‫So, here is another feature we've been
‫using in IAM without really knowing it,
‫but it is crucial to understanding AWS.
‫So when we configured many AWS services,
‫we gave them IAM roles
‫and for this the keywords that we passed
‫IAM roles to them.
‫And this was done, usually, when we set up a service
‫the first time.
‫So then the service, once it
‫has an IAM role, it can assume the role
‫and perform the actions it needs.
‫So when we pass a role to another service,
‫well, for example, when we created an EC2
‫instance role and assigned it to the EC2
‫instance we actually passed that role.
‫Or to a Lambda function where we created an
‫IAM role and then we passed it to learn
‫the function so that it could, for
‫example, call Amazon S3 or an ECS task
‫or when we passed a role to CodePipeline,
‫to allow it to invoke other services.
‫So all in all,
‫when we want to pass a role
‫to another AWS service we need the IAM
‫permission called iam:PassRole
‫and often this comes with another permission
‫called iam:GetRole to view the role being passed.
‫So the key here, though, is
‫that to pass a role to another service
‫you need the IAM pass for all permission.
‫So concretely what does an IAM policy look like?
‫Well, it looks like this.
‫So this IAM policy, if it was assigned to me,
‫allows me to do anything I want on EC2
‫such as creating instances, terminating them etc. etc.,
‫but the second part of the statement
‫allows me to pass a role,
‫and that role is called S3Access.
‫So that means that the only role I can assign
‫onto my EC2 instances is this one S3 access role.
‫And so for this I need the action
‫iam:PassRole to do it.
‫So the question is,
‫can any role be passed to any service?
‫And the answer is no.
‫Roles can only be passed to the
‫services based on what their trust allows,
‫and so a trust policy for a role
‫is an indication to say to which service
‫can assume that role.
‫So here is a normal IAM role,
‫so this is a trust policy for an IAM role.
‫And this is saying that only the
‫EC2 service, so this is in the principal service EC2,
‫only this EC2 service has
‫the trust to allow to assume that role
‫and so we've been using this without
‫knowing in the IAM policy,
‫so let's have a look.
‫But in IAM I go to roles and we can see
‫here there's a role name and here there
‫is a trusted entity,
‫and so this allows a specific service to assume that role.
‫So, for example, if we look at this
‫AWS CodePipeline service and we open it
‫we can see the permissions we have
‫allowed on this CodePipeline service
‫they're here in JSON, but the second time
‫in here is called Trust relationships
‫and this trust relationship is a policy document.
‫So I'll click on Show policy document
‫and this is the trust policy
‫which allows the CodePipeline service
‫to assume that role.
‫So this is why here you see
‫that the trusted identity providers
‫are codepipeline.amazonaws.com,
‫so this is the whole idea behind trust policy.
‫But, you can have a look, there is
‫a list of all the trusted entities in here.
‫So if I scroll down, for example,
‫and look at my Lambda functions so
‫if I go to Lambda and look at lamda-dynamodb-demo-role,
‫so this has a bunch of policies,
‫but if I go to the trust relationship
‫we can see the trust providers is lambda.amazonaws.com,
‫which is, if I look at the JSON document,
‫something like this.
‫So that's it, this was the behind the scenes.
‫So, again, to pass a role we
‫first need to create the correct trust
‫relationship, to allow the target service
‫to assume it, and then finally we need to
‫have the iam:PassRole permission to pass the
‫role onto the target service.
‫So that's it for me.
‫I hope you liked it, and I will see you
‫in the next lecture.