AWS IAM Service Linked Role
This page shows how to write Terraform and CloudFormation for IAM Service Linked Role and write them securely.
aws_iam_service_linked_role (Terraform)
The Service Linked Role in IAM can be configured in Terraform with the resource name aws_iam_service_linked_role. The following sections describe 5 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "aws_iam_service_linked_role" "AWSServiceRoleForEC2Spot" {
aws_service_name = "spot.amazonaws.com"
}
resource "aws_iam_service_linked_role" "AWSServiceRoleForEC2SpotFleet" {
aws_service_name = "spotfleet.amazonaws.com"
resource "aws_iam_service_linked_role" "ecs" {
aws_service_name = "ecs.amazonaws.com"
}
resource "aws_iam_service_linked_role" "rds" {
aws_service_name = "rds.amazonaws.com"
resource "aws_iam_service_linked_role" "lambda_replication_role" {
aws_service_name = "replicator.lambda.amazonaws.com"
}
resource "aws_iam_service_linked_role" "lambda_cloudfront_logger_role" {
aws_service_name = "logger.cloudfront.amazonaws.com"
resource "aws_iam_service_linked_role" "spotfleet" {
aws_service_name = "spotfleet.amazonaws.com"
}
resource "aws_iam_service_linked_role" "spot" {
aws_service_name = "spot.amazonaws.com"
resource "aws_iam_service_linked_role" "lambda_replication_role" {
aws_service_name = "replicator.lambda.amazonaws.com"
}
resource "aws_iam_service_linked_role" "lambda_cloudfront_logger_role" {
aws_service_name = "logger.cloudfront.amazonaws.com"
Parameters
-
arnoptional computed - string -
aws_service_namerequired - string -
create_dateoptional computed - string -
custom_suffixoptional - string -
descriptionoptional - string -
idoptional computed - string -
nameoptional computed - string -
pathoptional computed - string -
unique_idoptional computed - string
Explanation in Terraform Registry
Provides an IAM service-linked role.
Tips: Best Practices for The Other AWS IAM Resources
In addition to the aws_iam_account_password_policy, AWS IAM has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
aws_iam_account_password_policy
Ensure AWS IAM account password policies requires long passwords
It's better to enforce the use of long and complex passwords to reduce the risk of bruteforce attacks.
AWS::IAM::ServiceLinkedRole (CloudFormation)
The ServiceLinkedRole in IAM can be configured in CloudFormation with the resource name AWS::IAM::ServiceLinkedRole. The following sections describe 10 examples of how to use the resource and its parameters.
Example Usage from GitHub
Type: AWS::IAM::ServiceLinkedRole
Properties:
AWSServiceName: config.amazonaws.com
Description: 'AWS Config Service Linked Role'
ConfigBucket:
Type: "AWS::IAM::ServiceLinkedRole"
Properties:
AWSServiceName: es.amazonaws.com
Type: "AWS::IAM::ServiceLinkedRole"
Properties:
AWSServiceName: es.amazonaws.com
Description: "Service Linked Role for Amazon Elasticsearch Service"
Type: "AWS::IAM::ServiceLinkedRole"
Properties:
AWSServiceName: "es.amazonaws.com"
Type: AWS::IAM::ServiceLinkedRole
Properties:
AWSServiceName: config.amazonaws.com
"Type": "AWS::IAM::ServiceLinkedRole",
"Properties": {
"AWSServiceName": "autoscaling.amazonaws.com",
"Description": "Test SLR description",
"CustomSuffix":
"TestSuffix"
"AWS::IAM::ServiceLinkedRole": {
"Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-servicelinkedrole.html",
"Properties": {
"CustomSuffix": {
"Required": false,
"Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-servicelinkedrole.html#cfn-iam-servicelinkedrole-customsuffix",
"AWS::IAM::ServiceLinkedRole": {
"Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-servicelinkedrole.html",
"Properties": {
"CustomSuffix": {
"Required": false,
"Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-servicelinkedrole.html#cfn-iam-servicelinkedrole-customsuffix",
"AWS::IAM::ServiceLinkedRole": {
"Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-servicelinkedrole.html",
"Properties": {
"CustomSuffix": {
"Required": false,
"Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-servicelinkedrole.html#cfn-iam-servicelinkedrole-customsuffix",
"Type": "AWS::IAM::ServiceLinkedRole"
}
}
Parameters
-
CustomSuffixoptional - String -
Descriptionoptional - String -
AWSServiceNamerequired - String
Explanation in CloudFormation Registry
Creates an IAM role that is linked to a specific AWS service. The service controls the attached policies and when the role can be deleted. This helps ensure that the service is not broken by an unexpectedly changed or deleted role, which could put your AWS resources into an unknown state. Allowing the service to control the role helps improve service stability and proper cleanup when a service and its role are no longer needed. For more information, see Using service-linked roles in the IAM User Guide. To attach a policy to this service-linked role, you must make the request using the AWS service that depends on this role.
Frequently asked questions
What is AWS IAM Service Linked Role?
AWS IAM Service Linked Role is a resource for IAM of Amazon Web Service. Settings can be wrote in Terraform and CloudFormation.
Where can I find the example code for the AWS IAM Service Linked Role?
For Terraform, the prunux/terraform-aws-module-batch-ce, tanavel/izanagi and savannahar68/COVID19-Online_Justice_Court- source code examples are useful. See the Terraform Example section for further details.
For CloudFormation, the mynameisakash/aws-service-catalog-reference-architectures, wangluyang0201/77778888 and kamataryo/sandbox-serverless-vpc-elasticearch source code examples are useful. See the CloudFormation Example section for further details.
