- Okay, so now let's take a look at a demo
of creating roles.
You can see here
I'm logged into the Amazon console.
I'm in the IAM service,
and I've clicked over here into the roles section.
You can see that I don't have any roles yet.
Now again,
roles come in a number of different flavors.
They can be used to attach to an EC2 virtual machine.
They can be used by other AWS services.
They can be used for cross-account access.
So, picking up where we talked about the last example,
the last used case of using
a role for an EC2 instance.
I'm gonna create a new role,
and perhaps I have an application,
my web application or some kind of an API
running on an EC2 virtual machine.
That particular application
needs access to S3,
Amazon Simple Storage Service.
So I'm gonna call this one
myApplication.
Again, you can see that we have
all these different types of service roles.
Roles for various types of AWS services.
We have roles for cross-account access,
and roles for identity providers,
or a way to use federated users for your organization.
In this example,
we want to use a service role.
I want to use the very first one, the EC2.
It says that it, "allows EC2 instances
"to call AWS services on your behalf."
Again, this is a way that we can get our EC2 instances
access to various other Amazon resources
without having to embed credentials such as access keys
into our environment variables
or into our code.
That's exactly what we don't want to do.
So, here I wanna filter by S3,
and just as an example,
I'm going to choose S3 full access.
This is not necessarily how we might do it in production,
but just for the sake of this demo
I wanna give this particular application
access to S3.
In fact, let's do S3 read-only access.
That way our application is perhaps
pulling information out of S3
rather than writing.
So, I'm gonna choose that policy and click next.
Now we have created a role.
We've attached a policy to that role.
I'm gonna go ahead and finalize that.
You can see now that we have our role.
You can see that our role is allowed to read from S3.
We can see that the trust relationship says that
this role is trusting the EC2 service.
Now, when we go to launch EC2 instances
or virtual machines,
we can apply this role at the time we launch that machine,
and then any application,
and that's important to know,
any application
running on that virtual machine
will be able to read from S3.
If you log-in to the operating system of that machine
and use the CLI tools,
you can get access to S3.
If your application that is deployed to that machine
uses the SDK,
it can get access to S3.
So that is creating roles for use in EC2.