AWS IAM now provides role manager to set up IAM roles automatically

AWS Identity and Access Management (IAM) has introduced role manager, a new feature that automatically creates IAM roles when configuring supported AWS services such as AWS Lambda and Amazon EventBridge. The tool generates default roles or reuses existing ones with matching permissions, reducing manual configuration steps during service setup. Users can enable or disable role manager at any time and review the AWS-managed templates it deploys. Roles created by role manager appear in the IAM console as standard roles, fully editable by administrators.

Role manager supports six AWS service consoles at launch, including Lambda and EventBridge, with additional services expected to be added over time. When enabled, it applies predefined templates tailored to each service’s workflow, ensuring roles meet minimum permission requirements. Administrators can later refine these roles using IAM Access Analyzer to enforce least-privilege principles. The feature is designed to streamline onboarding while maintaining transparency and control over role configurations.

The new capability is available in all AWS Regions except AWS GovCloud (US) and China Regions, ensuring broad accessibility for most users. AWS emphasizes that roles created by role manager are standard IAM roles, allowing full customization and management through existing IAM tools. This approach aims to balance automation with user oversight, reducing initial setup complexity without compromising security governance.

To assist users, AWS has published guidance on the AWS Security Blog and IAM User Guide, detailing how role manager rethinks IAM role creation and how to implement it in workflows. The feature is part of AWS’s ongoing efforts to simplify identity management while reinforcing security best practices through automated, template-driven role provisioning.