[AWS Experiment] 5 - IAM:PassRole
Tags: aws
Published: 2022-01-01 21:51:00

> *IAM:PassRole may have been confusing to you. But here is the most clear explanation of what IAM:PassRole does.*

## IAM:PassRole Overview

#### What exactly "passing" a role?

- Whenever you create any AWS services on console, you would often find "attaching existing roles / create roles" option. This is the most use case of IAM:PassRole. Without IAM:PassRole permission, we cannot give any IAM Role to services.

- Technically "passing" a role is the same as "attaching" a role to any AWS services.

#### What is IAM:PassRole?

- IAM:PassRole basically allows an IAM user / role to pass a specific role(s) to another any AWS services, nothing more than that. [AWS Documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_iam-passrole-service.html)

- Diagram

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6qo3gr8m8dzn3r1rblhg.png)

- So any role can be passed to any services?

    - **No.** Only when the role has the service - that you want to pass(attach) a role - as 'trusted entities (Trust Relationships)'
    - To pass a role, we first need to create a correct trust relationships.
    - Normally this rule tend to be overlooked, because AWS manages for us most of the time.


## Experiment

- Notice that the custom role `Demo_EC2_ IAMReadOnlyPermission` that I am using for this experiment has `ec2.amazonaws.com` as its trusted entities.

#### Create an IAM User without any IAM:PassRole permission

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/z6sjqfx854pct0spt25x.png) 
> Created an IAM User `user-with-no-PassRole`

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0ckyxnetxmqsnfj0npiz.png)
> Denied all PassRole permission

- Expected result: Whenever I try to create any AWS service with **any role attached, it must be denied.**

#### Launching EC2 with role attached

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ie3n9f53q1gkej4rwd4d.png)
> Giving IAMReadOnlyPermission to the instance

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/k8pz9t7feh8lygdjlzk0.png)
> The launch failed


#### Change the policy and re-launch the EC2 instance

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/z0490vvl5id4c5om4zrj.png)

> Changed the policy if the aws:Service equals to ec2 then allow

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8wu06ts8et9vrw105alw.png)

> And the launch succeeded

## Examples

#### Allow an IAM user or role to pass any role to the Amazon EC2 service to be used with instances in the Region us-east-1 or us-west-1 (IAM Policy).

```json
{
    "Effect": "Allow",
    "Action": "iam:PassRole",
    "Resource": "*",
    "Condition": {
        "StringEquals": {"iam:PassedToService": "ec2.amazonaws.com"},
        "StringLike": {
            "iam:AssociatedResourceARN": [
                "arn:aws:ec2:us-east-1:111122223333:instance/*",
                "arn:aws:ec2:us-west-1:111122223333:instance/*"
            ]
        }
    }
}
```

#### Allow passing any IAM service role to the Amazon CloudWatch service (IAM Policy).

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "*",
            "Condition": {
                "StringEquals": {"iam:PassedToService": "cloudwatch.amazonaws.com"}
            }
        }
    ]
}
```

## Conclusion

- Without IAM:PassRole we cannot attach any role to other AWS service using current IAM User, Role, or Group.