Editing an IAM Service Role, and Attaching Service Roles to AWS Resources
Tags: service, role, policy, iam
Published: 2024-03-31 13:00:16

## Overview

One common challenge you might have come across is how to edit service roles for AWS resources. This is usually necessary when you forget to attach an appropriate role to the service in question. After executing a task, you tend to get errors such as:

`Insufficient permission; or the provided role does not have sufficient permissions.` 

Here we will describe how this can be solved by creating a new service role, and modifying it to suite our purpose. We will also show how the new role can be attached to an existing resource. 

## What is a Service Role?

A service-linked role is a unique type of IAM role that is linked directly to an AWS service. Service-linked roles are predefined by the service and include all the permissions that the service requires to call other AWS services on your behalf.

## Scenario 

We require an AWS CodeDeploy service role for EC2 in order to be able to deploy an application to an EC2 instance. We, therefore, need to create one and attach it to our EC2 instance.

## Procedure

In the AWS console, go to **IAM**, then **Roles**, then **Create role**. Under **Trusted entity type** select **AWS service**; and under **Use case**, select **EC2**.  

Under **Add permissions**, search for the appropriate permission. In our case, we will use the _AWSCodeDeployRole_ role. Select **Next** and give your new role a meaningful name. Then click **Create role**.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zzfjgh4wma1rhsoqskoi.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wsrgqurr9dw61azats66.png)

_Note: Do not bother to edit the role using the **Edit** button, because you will not be able to. Just go ahead and create; the editing will be done after the creation._ 

Go back to Roles or click on **View role** to view your newly created service role. Select the **Trust relationships** tab. Then click the **Edit trust policy** button, and make the necessary modifications to the policy settings.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6dxzd4qsduo0e0omhx9s.png)

In our case, we change the _ec2_ on line 7 to _codedeploy_. You can now return to your AWS resource and attach the newly created role to it.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ue81u7xe2m6sovw3r1eg.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o4359nc7yto7yjychtz9.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xsknzcc4fe592tdlnybv.png)

In our own scenario (demonstrated in the clips above), we created an AWS service role for EC2 instances. Note that we have attached the new role by first selecting he instance, then clicking on **Actions** -> **Security** -> **Modify IAM role** (First picture after the last paragraph). When attached to an instance, this service role will allow EC2 instances to call _AWSCodeDeploy_ on our behalf. These types of roles are important for automating the deployment of workloads into the AWS cloud.

Thank you for reading.

Reference: [AWS official documentation on service-linked roles.](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html), accessed 2024/03/31