Overview of role templates
A role template is a role blueprint used to create new roles. The template sets the role's trust policy and permissions so you get a ready-to-use role for a service without writing the policies yourself.
Role manager uses AWS-managed role templates, but you can also use role templates without role manager. This page explains how role templates work and lists the template for each service.
How role templates work
A role template contains a trust policy and permissions, and has an Amazon Resource Name (ARN). The trust policy defines which principals can assume the role. The permissions define what the role can do. Template versions are immutable. When AWS updates a template, it publishes a new version rather than changing an existing one.
Role templates may accept additional parameters to customize and scope the role's
properties and permissions. For example, a template might take a RoleName for the
role it creates, or a resource identifier such as a bucketName. When role manager
creates a role in the console, it applies the parameters to the permissions and trust policy
for the role. When you create a role from a template directly with the IAM API, you supply
these parameters.
To create a role from a template, use the iam:AcquireRole API with the
template's ARN and pass the parameters that the template requires.
A role template's definitions can change between versions. To see the current trust policy
and permissions for a template, retrieve it with iam:GetRoleTemplateVersion using
the template ARN. AWS recommends inspecting the template before relying on it, especially
for a template that grants broad access.
How role manager uses templates
When creating a resource in a supported service console, role manager provides a role from
the template that matches the service and use case. Role manager chooses the template and
supplies the parameters for you. The result is the same role that you would get calling
iam:AcquireRole. To enable role manager, see Manage access to role manager.
Role template directory
The following table lists the role template for each service that role manager supports, with the template ARN and the parameters it takes. Use the ARN to create a role from the template, or to review what role manager grants for that service. Services are listed alphabetically.
| Service | Role template | Template ARN | Parameters |
|---|---|---|---|
| AWS Elastic Beanstalk | PowerUserRoleTemplate | arn:aws:iam::aws:role-template/iam.amazonaws.com/PowerUserRoleTemplate:1 |
AWSServiceName, RoleName |
| Amazon EventBridge | PowerUserRoleTemplate | arn:aws:iam::aws:role-template/iam.amazonaws.com/PowerUserRoleTemplate:1 |
AWSServiceName, RoleName |
| AWS Lambda | PowerUserRoleTemplate | arn:aws:iam::aws:role-template/iam.amazonaws.com/PowerUserRoleTemplate:1 |
AWSServiceName, RoleName |
| Amazon SageMaker Unified Studio | AmazonSageMakerAdminIAMPermissiveExecutionRoleTemplate | arn:aws:iam::aws:role-template/datazone.amazonaws.com/AmazonSageMakerAdminIAMPermissiveExecutionRoleTemplate:1 |
CMK_ENABLED, RoleName, accountId, keyAccountId, keyRegion, kmsKeyId |
| Amazon SageMaker Unified Studio | AmazonSageMakerUserIAMPermissiveExecutionRoleTemplate | arn:aws:iam::aws:role-template/datazone.amazonaws.com/AmazonSageMakerUserIAMPermissiveExecutionRoleTemplate:1 |
RoleName, accountId |
| AWS Secrets Manager | AWSSecretsManagerRotationRoleTemplate | arn:aws:iam::aws:role-template/secretsmanager.amazonaws.com/AWSSecretsManagerRotationRoleTemplate:1 |
ADMIN_RESOURCE_ENABLED, CMK_ENABLED, RoleName, accountId, adminType, kmsKeyArn, region, resourceType |
| AWS Step Functions | PowerUserRoleTemplate | arn:aws:iam::aws:role-template/iam.amazonaws.com/PowerUserRoleTemplate:1 |
AWSServiceName, RoleName |
Related information
