ServiceLinkedRole

Source: src/AWS/IAM/ServiceLinkedRole.ts

An IAM role linked to (and managed by) a specific AWS service.

The linked service controls the role’s trust and permissions policies; the only mutable aspect is the description. Deletion is asynchronous — the provider submits a deletion task and waits (bounded) for it to complete, failing with ServiceLinkedRoleDeletionFailed when the linked service still has resources using the role.

Some services auto-create their service-linked role on first use; deploying this resource over an existing role adopts it (the create API reports the collision and the provider converges on the existing role).

Creating Service-Linked Roles

Auto Scaling Service-Linked Role

const role = yield* ServiceLinkedRole("AutoScalingRole", {
  awsServiceName: "autoscaling.amazonaws.com",
});

Suffixed Role for a Dedicated Workload

const role = yield* ServiceLinkedRole("WorkloadRole", {
  awsServiceName: "autoscaling.amazonaws.com",
  customSuffix: "analytics",
  description: "Auto Scaling role scoped to the analytics workload",
});