This is a hands-on walkthrough for turning on and using AWS IAM role manager — the feature, generally available since August 12, 2026, that automatically creates or reuses the IAM roles your AWS services need instead of leaving it to whoever’s setting up the service that day. We’ll enable it, set up a Lambda function, watch role manager do its thing, and then inspect exactly what it built using the CLI so you’re not just trusting a green checkmark in the console.
Prerequisites
Before you start, make sure you have the following in place. Skipping any of these will make step 5 onward a lot less useful.
- An AWS account with IAM permissions to create roles and policies (
iam:CreateRole,iam:AttachRolePolicy,iam:GetRole,iam:ListAttachedRolePoliciesat minimum) - The AWS CLI installed and configured with credentials for the account you’re testing in
- Console access to IAM and to at least one of the six supported services — this walkthrough uses AWS Lambda
- Ideally a sandbox or dev account — you’re about to let AWS create IAM roles automatically, and you want room to inspect and delete freely
Steps to Set Up AWS IAM Role Manager
Work through these in order. Each step includes the exact command or console action, so you can follow along instead of guessing what “set it up” means.
-
Confirm role manager’s current status. Log into the IAM console and check the role manager settings page to see if it’s already enabled for the account. If you’d rather verify programmatically first, list your existing roles so you have a “before” baseline to compare against later:
aws iam list-roles \ --query "Roles[].{Name:RoleName,Created:CreateDate}" \ --output table - Enable IAM role manager. In the IAM console, navigate to role manager settings and toggle it on for the account. This is account-wide — it applies to any supported service console you set up going forward, until you toggle it off again.
-
Set up a supported service — Lambda. Go to the Lambda console and create a new function. On the permissions step, instead of manually attaching or creating an execution role, let the console flow proceed with role manager active. Give the function a clear name so you can find its role afterward:
Function name: role-manager-demo Runtime: Python 3.13 Execution role: (leave on default — let role manager handle it) -
Watch role manager create (or reuse) a role. Once the function is created, note the execution role name shown in the Lambda console’s Configuration > Permissions tab. Confirm it against your CLI baseline — if it’s new, it won’t have appeared in your step 1 output:
aws iam list-roles \ --query "Roles[?contains(RoleName, 'role-manager-demo')].{Name:RoleName,Created:CreateDate}" \ --output table -
Inspect the AWS-managed template role manager used. Pull the full role definition, its trust policy, and its attached managed policies so you know exactly what permissions it granted, per the managed vs. inline policy model:
aws iam get-role --role-name <role-name-from-step-4> aws iam list-attached-role-policies \ --role-name <role-name-from-step-4> aws iam get-policy-version \ --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole \ --version-id v1 -
Check for inline policies too. AWS-managed templates sometimes pair a managed policy with a scoped inline policy for resource-specific access. Don’t skip this check:
aws iam list-role-policies --role-name <role-name-from-step-4> -
Decide: keep it, or customize it. If the permissions match what your function actually needs and nothing more, you’re done — this is the least-privilege outcome you wanted without hand-writing a policy. If your function needs more, say access to a specific DynamoDB table, add a scoped inline policy rather than attaching something broad:
aws iam put-role-policy \ --role-name <role-name-from-step-4> \ --policy-name dynamodb-table-access \ --policy-document '{ "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": ["dynamodb:GetItem", "dynamodb:PutItem"], "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/demo-table" }] }' -
Test the reuse behavior. Create a second Lambda function with an identical permission requirement — same runtime, same basic execution needs — and confirm role manager reuses the role from step 4 instead of creating a duplicate. This is the behavior that actually kills role sprawl; check your role count didn’t grow:
aws iam list-roles \ --query "length(Roles[?contains(RoleName, 'role-manager')])" -
Confirm you can disable role manager cleanly. Toggle it off in the IAM console settings and verify the roles already created are untouched:
aws iam get-role --role-name <role-name-from-step-4>The role and its permissions should be exactly as they were. Disabling role manager stops future automation — it doesn’t roll back what it already built. See the AWS What’s New page for any changes to this behavior as the feature matures.
What You Built
You now have a working IAM role manager setup: enabled at the account level, exercised against a real Lambda function, and verified twice over — once by inspecting the AWS-managed template it deployed, and once by confirming it reused the same role for a second function instead of spinning up a duplicate. You’ve also confirmed the escape hatches actually work: you can layer a scoped inline policy on top of the managed template when you need more, and you can disable role manager without losing anything it already created. That’s the whole value proposition in miniature — less manual role creation, a documented default permission set you can point to in an audit, and full control any time you want to override it.
At Enkompass (enkompass.net), this is our home turf. We set up AWS accounts the right way the first time, so your team isn’t reverse-engineering IAM roles a year from now. If you’d rather have seasoned cloud people handle it instead of learning the hard way at 2 AM, let’s talk. Reach out through our contact page or call us directly at +1-828-436-5667 — we’ll help you turn this from a someday-project into a done-deal.