Role Manager automates IAM role creation across six AWS services
Generally available since August 12, 2026, Role Manager automatically creates or reuses the IAM roles AWS services need, from AWS Lambda to Amazon EventBridge. The time savings are real, but a default role is not a least-privilege role — here is how to use it without eroding your least-privilege posture.
August 12, 2026. AWS made Role Manager generally available, a capability of AWS Identity and Access Management (IAM) that automatically creates and configures the roles your services need. At launch it covers six service consoles, including AWS Lambda and Amazon EventBridge. For a cloud engineer, the promise is simple: never again interrupt resource creation to hand-write a role.
The stakes are subtler than a time saving. Role Manager solves the “default role” problem by making it explicit and traceable — but it also introduces a trade-off the security team has to look at squarely: the role it attaches to a Lambda function ships with the PowerUserAccess managed policy, which is anything but minimal.
What Role Manager actually does
Role Manager has two states, enabled and disabled. You turn it on in the IAM console, under Account settings. Inside an organization, an administrator can gate its use with a service control policy (SCP) that decides which member accounts may enable or use it.
Under the hood, the console calls a new API, AcquireRole. It looks up the AWS-managed role template that matches the task, provisions the role from that template, and returns it to the service. Depending on the case, AcquireRole either creates a new role or reuses an existing one that already fits the required permissions — so an account does not fill up with duplicates for the same task.
Three properties make it defensible in production:
- The roles are ordinary IAM roles. You view, edit, and delete them like any role you authored yourself.
- Every role keeps a trace of its template. GetRole and ListRoles return the originating template reference, and AWS CloudTrail records each creation.
- The permissions remain yours. Role Manager creates the role using your own IAM permissions, not a separate role-manager permission. Provisioning a new role requires at minimum the create-and-attach permissions; reusing an existing role needs only iam:GetRole and iam:GetRoleTemplateVersion.
The clearest use case is an EventBridge rule. Without Role Manager, creating a rule that invokes an SQS queue means pausing to write the role, its trust policy, and its permissions, then returning to finish the rule. With Role Manager, you define the rule and its target, choose Create, and the role is provisioned and attached in the same flow — without ever opening the role-creation form.
The six consoles covered at launch — Lambda, EventBridge, and four others — give the measure of the ambition: cover the most common flows first, then extend coverage to other services over subsequent releases. For now, an uncovered service keeps working exactly as before, with its manual or built-in role creation.
The point of tension: PowerUserAccess by default
Not all cases are equal. When the task is to run your own code — the Lambda case — AWS cannot know in advance which services that code will call. Role Manager then attaches an execution role carrying the PowerUserAccess managed policy.
That choice deserves a pause. PowerUserAccess grants access to all AWS services except management of IAM, AWS Organizations, and account settings. It is, by a wide margin, the broadest policy a freshly created function can receive. The template does scope the role to trust only the Lambda service, but inside that boundary the function can call nearly anything.
In other words, Role Manager moves the IAM problem from one place to another. It removes the friction of “create the role” at the price of a deferred “tighten the role.” That is not a design flaw — it is an explicit trade-off, and AWS documents it in black and white. But it is a trade-off teams must understand, not endure.
Why IAM is still the weak link
The topic is not academic. IAM has been, for years, the primary cloud compromise vector — not the zero-day. The intrusion into the European Commission’s AWS account in early August 2026, with more than 350 GB exfiltrated, relied on client-side identity management failure rather than an AWS infrastructure flaw, as we documented.
In that context, a tool that creates roles on your behalf is a double-edged sword. On one side, it eliminates the toxic reflex of “pasting an over-broad policy because it is faster.” On the other, it institutionalizes a form of over-permission by default — exactly what the least-privilege principle is meant to prevent. The difference comes down to what you do next.
The exit path: Access Analyzer and tightening
The good news is that the exit is designed in. AWS offers an explicit two-phase path:
- During development, leave Role Manager enabled: stand the service up in minutes, iterate, and do not block on IAM.
- As the workload matures, disable Role Manager and run IAM Access Analyzer, whose unused-access analysis is offered free for 90 days. The tool inspects how each role has actually been used and recommends a policy scoped to only the permissions it needs.
Disabling Role Manager breaks nothing: resources keep their roles, those roles stay in the account until you change them, and you resume authoring roles manually as before. To tighten a single role rather than the whole account, just edit it: it then leaves Role Manager’s control and becomes a standard customer-managed role, your changes preserved.
AWS’s own guidance draws the line without ambiguity: keep Role Manager enabled in development and sandbox accounts; in production accounts, disable it and tighten the roles it created before going live.
One caveat for teams that provision everything as code: Role Manager is a console convenience, not an IaC primitive. If your roles are defined in Terraform or CloudFormation, it will not touch them — and that is exactly as it should be. Its value is in the click-and-build flow, not in replacing a reviewed, versioned role definition.
Either way, the follow-up matters more than the feature: a default role that is never revisited is a future incident waiting to happen.
Verdict
Role Manager is neither a revolution nor a trap — it is a default setting, with the virtues and risks of any default setting. It lowers the IAM entry cost to the point where a developer with no IAM experience can stand up a service in minutes, and it does so without sacrificing visibility: every role is traceable, ordinary, and documented.
The recommendation is conditional and specific. If you operate development or sandbox accounts, enable Role Manager without hesitation — the time saved is real, and the risk there is bounded by construction. If you operate production or regulated accounts, treat Role Manager as scaffolding: let it build during the construction phase, then disable it and pass every role it created through Access Analyzer before go-live. And in every case, require an SCP that controls who can enable it — because a tool that creates roles on your behalf deserves, at minimum, that you decide who is allowed to switch it on.