Answers: <p>The purpose of the <code>AssumeRolePolicyDocument</code> is to contain the trust relationship policy that grants an entity permission to assume the role.</p>
  <p>In your example it's granting the Lambda service the ability to assume</p>
  <p><strong>References</strong></p>
  <p><a href="https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html" rel="noreferrer">https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html</a></p>
  <p><a href="https://docs.aws.amazon.com/cli/latest/reference/iam/create-role.html" rel="noreferrer">https://docs.aws.amazon.com/cli/latest/reference/iam/create-role.html</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2018-10-02T23:55:13.230Z
Answers: I guess I'm confused as to why it has to assume a role? Why cant a policy just be assigned to it?
Answers: Dr. Chocolate
Answers: CC BY-SA 4.0
Answers: 2018-10-03T00:49:11.930Z
Answers: @mutant_city, You need to allow Lambda permission to assume a role.  Without doing so Lambda wouldn't be able to do anything in your environment.  The role has policies assigned to it that give Lambda the privileges it needs to do its work.
Answers: kenlukas
Answers: CC BY-SA 4.0
Answers: 2018-10-03T01:58:42.253Z
Answers: Ok. So you allow the lambda to assume the role that you have attached your policies to...basically?
Answers: Dr. Chocolate
Answers: CC BY-SA 4.0
Answers: 2018-10-03T12:22:48.707Z
Answers: yes, in a nutshell that's it.
Answers: kenlukas
Answers: CC BY-SA 4.0
Answers: 2018-10-02T15:05:14.813Z
Answers: 2020-07-22T04:57:17.673Z
Answers: 2020-07-22T04:57:17.673Z
Answers: kenlukas
Answers: <p>I think it's much clearer when considering the user that creates a role isn't necessarily the one attaching it for use somewhere:</p>
  
  <ul>
  <li><p><code>AssumeRolePolicyDocument</code> is a restriction placed by the user that creates the role - e.g. possibly an admin. It prevents other users from attaching it to any AWS service / user they like. Also, it tells nothing about <em>where</em> it's actually used. It's a protection on the Role-side (treating Role as a resource that should also be protected).</p></li>
  <li><p>OTOH, actually assigning a role to a service / user, is done by users that actually need now some service to have permissions. And they're allowed to do it only if the Role's <code>AssumeRolePolicyDocument</code> allows it.</p></li>
  </ul>
  
  <p>Granted, when you're the sole user you might not care much about it. It does, though, add more security and documents (forcibly :) ) how the role is intended to be used.</p>
  
Answers: CC BY-SA 4.0
Answers: 2020-06-01T10:13:19.287Z
Answers: 2020-06-01T10:13:19.287Z
Answers: yair
Answers: <p>For anyone who is scratching their head at the naming convention:</p>
  
  <p><strong>AssumeRolePolicyDocument</strong> (in CloudFormation yaml) = <strong>Trust Relationships</strong> (in AWS Console web GUI)</p>
  
  <p><strong>Policies</strong> (in CloudFormation yaml) = <strong>Permissions</strong> (in AWS Console web GUI)</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-04-08T02:42:13.880Z
Answers: Is a "Trust Policy" as described here: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html the same thing as the JSON file that you pass to the `--assume-role-policy-document` flag in the `aws iam create-role` subcommand? My main confusion is because AWS insists on inventing new phrases and then airdropping the word "policy" or "role" in the phrase like: resource-based policy, role policy, JSON policy document, trust relationship policy document, assume-role-policy-document, it always seems like the phrases might be pointing to the same thing but I can't be sure.
Answers: mbigras
Answers: CC BY-SA 4.0
Answers: 2021-04-09T15:02:32.530Z
Answers: @mbigras Yes, I think that is the case. IAM CLI (based on the linked document) expects JSON and the linked document also expects a JSON document.
Answers: Tony Sepia
Answers: CC BY-SA 4.0
Answers: 2020-05-31T20:29:16.233Z
Answers: 2020-05-31T20:29:16.233Z
Answers: Tony Sepia
Answers: <p>The purpose of assume role policy document is to <a href="https://docs.aws.amazon.com/cli/latest/reference/iam/update-assume-role-policy.html" rel="noreferrer">grants an IAM entity permission to assume a role</a>. It is also known as a "role trust policy".</p>
  
  <p>In other words, for given permissions you set, it <em>allow users from certain AWS account to assume this role and access that account</em>.</p>
  
  <p>It is recommended that you update the role trust policy to restrict access to only authorized users, otherwise any AWS account could assume the role and access that account.</p>
  
  <p>By <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#Principal_specifying" rel="noreferrer">specifying <em>Principal</em></a> using <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns" rel="noreferrer">Amazon Resource Name (ARN)</a> of the AWS account, IAM user, IAM role, federated user, or assumed-role user, you allow or deny access to assume that role (<a href="https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html" rel="noreferrer"><code>sts:AssumeRole</code></a>).</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-03-27T23:04:38.003Z
Answers: 2019-03-27T23:04:38.003Z
Answers: kenorb
Body: <p>I'm confused as to what the purpose of <code>AssumeRolePolicyDocument</code> is.<br />
  It seems like to create a role all you need is a parent name that you can attach policies to.</p>
  <p>It seems like <code>AssumeRolePolicyDocument</code> is that parent name but somehow there's more to it.</p>
  <p>What is this doing?</p>
  <pre><code>&quot;AssumeRolePolicyDocument&quot;: {
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Principal&quot;: {
                  &quot;Service&quot;: [&quot;lambda.amazonaws.com&quot;]
              },
              &quot;Action&quot;: [&quot;sts:AssumeRole&quot;]
          }
      ]
  }
  </code></pre>
  
Tags: <amazon-web-services><aws-iam>
Title: What is the purpose of AssumeRolePolicyDocument in IAM?
UserDisplayName: Dr. Chocolate
ThreadText: # What is the purpose of AssumeRolePolicyDocument in IAM?
  
  (Asked by: username_0 on 2018-10-01)
  
  I'm confused as to what the purpose of `AssumeRolePolicyDocument` is.  
  It seems like to create a role all you need is a parent name that you can attach policies to.
  
  It seems like `AssumeRolePolicyDocument` is that parent name but somehow there's more to it.
  
  What is this doing?
  
  ```
  "AssumeRolePolicyDocument": {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Principal": {
                  "Service": ["lambda.amazonaws.com"]
              },
              "Action": ["sts:AssumeRole"]
          }
      ]
  }
  
  ```
  
  **Tags:** amazon-web-services, aws-iam
  
  
  ---
  
  ## 4 answers
  
  ### Answer by username_1 on 2018-10-02. Score: 16 | Accepted answer
  
  The purpose of the `AssumeRolePolicyDocument` is to contain the trust relationship policy that grants an entity permission to assume the role.
  
  In your example it's granting the Lambda service the ability to assume
  
  **References**
  
  <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html>
  
  <https://docs.aws.amazon.com/cli/latest/reference/iam/create-role.html>
  
  > **Comments:**
  > **username_0**: I guess I'm confused as to why it has to assume a role? Why cant a policy just be assigned to it?  
  > **username_1**: @mutant_city, You need to allow Lambda permission to assume a role.  Without doing so Lambda wouldn't be able to do anything in your environment.  The role has policies assigned to it that give Lambda the privileges it needs to do its work.  
  > **username_0**: Ok. So you allow the lambda to assume the role that you have attached your policies to...basically?  
  > **username_1**: yes, in a nutshell that's it.  
  
  ---
  
  ### Answer by username_3 on 2020-05-31. Score: 13
  
  For anyone who is scratching their head at the naming convention:
  
  **AssumeRolePolicyDocument** (in CloudFormation yaml) = **Trust Relationships** (in AWS Console web GUI)
  
  **Policies** (in CloudFormation yaml) = **Permissions** (in AWS Console web GUI)
  
  > **Comments:**
  > **username_4**: Is a "Trust Policy" as described here: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html the same thing as the JSON file that you pass to the `--assume-role-policy-document` flag in the `aws iam create-role` subcommand? My main confusion is because AWS insists on inventing new phrases and then airdropping the word "policy" or "role" in the phrase like: resource-based policy, role policy, JSON policy document, trust relationship policy document, assume-role-policy-document, it always seems like the phrases might be pointing to the same thing but I can't be sure.  
  > **username_3**: @username_4 Yes, I think that is the case. IAM CLI (based on the linked document) expects JSON and the linked document also expects a JSON document.  
  
  ---
  
  ### Answer by username_5 on 2019-03-27. Score: 10
  
  The purpose of assume role policy document is to [grants an IAM entity permission to assume a role](https://docs.aws.amazon.com/cli/latest/reference/iam/update-assume-role-policy.html). It is also known as a "role trust policy".
  
  In other words, for given permissions you set, it *allow users from certain AWS account to assume this role and access that account*.
  
  It is recommended that you update the role trust policy to restrict access to only authorized users, otherwise any AWS account could assume the role and access that account.
  
  By [specifying *Principal*](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#Principal_specifying) using [Amazon Resource Name (ARN)](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns) of the AWS account, IAM user, IAM role, federated user, or assumed-role user, you allow or deny access to assume that role ([`sts:AssumeRole`](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html)).
  
  
  ---
  
  ### Answer by username_2 on 2020-06-01. Score: 8
  
  I think it's much clearer when considering the user that creates a role isn't necessarily the one attaching it for use somewhere:
  
  * `AssumeRolePolicyDocument` is a restriction placed by the user that creates the role - e.g. possibly an admin. It prevents other users from attaching it to any AWS service / user they like. Also, it tells nothing about *where* it's actually used. It's a protection on the Role-side (treating Role as a resource that should also be protected).
  * OTOH, actually assigning a role to a service / user, is done by users that actually need now some service to have permissions. And they're allowed to do it only if the Role's `AssumeRolePolicyDocument` allows it.
  
  Granted, when you're the sole user you might not care much about it. It does, though, add more security and documents (forcibly :) ) how the role is intended to be used.
  
  
  ---
  
  