AWS Storage Gateway User Guide
Access Control
•
AWS service access
– A service role is an IAM role that a service assumes to perform actions in your
account on your behalf. When you set up some AWS service environments, you must define a role
for the service to assume. This service role must include all the permissions that are required for
the service to access the AWS resources that it needs. Service roles vary from service to service, but
many allow you to choose your permissions as long as you meet the documented requirements
for that service. Service roles provide access only within your account and cannot be used to grant
access to services in other accounts. You can create, modify, and delete a service role from within
IAM. For example, you can create a role that allows Amazon Redshift to access an Amazon S3 bucket
on your behalf and then load data from that bucket into an Amazon Redshift cluster. For more
Creating a Role to Delegate Permissions to an AWS Service
in the
IAM User Guide
.
•
Applications running on Amazon EC2
– You can use an IAM role to manage temporary credentials
for applications that are running on an EC2 instance and making AWS CLI or AWS API requests. This
is preferable to storing access keys within the EC2 instance. To assign an AWS role to an EC2 instance
and make it available to all of its applications, you create an instance profile that is attached to
the instance. An instance profile contains the role and enables programs that are running on the
EC2 instance to get temporary credentials. For more information, see
Permissions to Applications Running on Amazon EC2 Instances
IAM User Guide
.
Access Control
You can have valid credentials to authenticate your requests, but unless you have permissions you cannot
create or access AWS Storage Gateway resources. For example, you must have permissions to create a
gateway in AWS Storage Gateway.
The following sections describe how to manage permissions for AWS Storage Gateway. We recommend
that you read the overview first.
•
Overview of Managing Access Permissions to Your AWS Storage Gateway (p. 296)
•
Identity-Based Policies (IAM Policies) (p. 297)
API Version 2013-06-30
295
