Skip to content

Do any permission policy types apply to service-linked roles?

0

I have checked the documentation of both Service Control Policies (SCPs) and Resource Control Policies (RCPs) and I see that neither type impacts the effective permissions of any service-linked roles. So I checked the documentation of IAM identity-based and resource-based policies and I do not find anything stating whether they impact service-linked roles.

Therefore my question is: are there any permission policy types that apply to service-linked roles?


Documentation pages that I have checked:

2 Answers
0

You're correct that service-linked roles are not affected by Resource Control Policies (RCPs). According to the documentation, RCPs do not apply to calls made by service-linked roles. Service-linked roles enable AWS services to perform necessary actions on your behalf and can't be restricted by RCPs.

Service-linked roles are a unique type of IAM role that is directly linked to an AWS service. These roles are predefined by the AWS service and include all the permissions that the service requires to call other AWS services on your behalf. The permissions for service-linked roles are defined by the AWS service that owns the role, and these permissions cannot be attached to any other IAM entity.

The permissions of a service-linked role include a trust policy and a permissions policy. The trust policy defines which service can assume the role, and the permissions policy defines what actions the role can perform. These policies are predefined by the AWS service and cannot be modified by users, except in some cases where you might be able to edit the description of the role.

In summary, service-linked roles have their own predefined permissions policies that are managed by the respective AWS service, and they are not affected by RCPs. The permissions of service-linked roles are determined solely by the AWS service that owns them.
Sources
Resource control policies (RCPs) - AWS Organizations
Using service-linked roles for AWS Marketplace - AWS Marketplace
Using Service-Linked Roles for AWS Config - AWS Config

answered 5 months ago
EXPERT
reviewed 5 months ago
  • Unfortunately this answer does not answer my question, which in simpler words is: are service-linked roles affected by resource-based policies?

0
EXPERT
answered 5 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.