Gate 1
Account and organization
Record account type, organization and OU, Role Manager state, account-property owner, SCPs, approved consoles, and whether a sandbox or production boundary applies.
Template-to-production authority check
AWS IAM Role Manager Readiness
Describe the AWS account, organization, service, caller, role template, resource, evidence, and production plan. Generate a checklist without treating automatic role creation as automatic least privilege.
Four readiness gates
Gate 2
Caller and template
Name the calling principal, exact template ARN and version, replacement parameters, required underlying IAM actions, trust policy, and intended create-or-reuse outcome.
Gate 3
Resource and evidence
Map the resulting role to one accountable resource and owner, retain the AcquireRole CloudTrail event, inspect materialized policies, and test both allowed and denied paths.
Gate 4
Least privilege and lifecycle
Define activity coverage, rare paths, Access Analyzer review, policy canary, rollback, drift monitoring, template-management exit, and role retirement before production.
Classify the deployment stage
Ready for sandbox
The supported console, caller, template, SCP, CloudTrail, owner, cost boundary, and expiry are known; the role remains a development starting point.
Ready for staging
The materialized role is inventoried, representative and denial tests pass, rare paths are planned, and a reviewed scope-down candidate has a rollback.
Not ready for production
The role is broad, shared without ownership, missing template evidence, blocked from audit, or promoted without least-privilege, canary, and recovery proof.
Minimum acceptance evidence
Retrieve the exact template version, run one approved and one intentionally denied acquisition path, reconcile the CloudTrail event to the role and service resource, inspect the materialized trust and permissions, exercise representative and rare workload paths, canary a narrower policy, and prove rollback. Do not test broad permissions against production data.
Continue with the source guides
Setup and controls Review supported consoles, account permissions, SCP patterns, CloudTrail, and disabling behavior. AcquireRole and templates Inspect immutable versions, parameters, create-or-reuse behavior, caller permissions, and provenance. Production least privilege Use activity evidence, Access Analyzer review, rare paths, canaries, rollback, and lifecycle ownership.
Official facts checked August 19, 2026 against AWS IAM documentation and the AWS Security Blog. Recheck account defaults, supported services, exact template versions, SCPs, analyzer behavior, and organization policy before use.
Frequently Asked Questions
It creates a review checklist from the account, organization, caller, template, resource, CloudTrail, least-privilege, and lifecycle facts you provide. It does not connect to AWS, enable Role Manager, create a role, or change policies.
No. It automates supported role provisioning, but AcquireRole still evaluates the caller's underlying IAM actions, and an owner must review the resulting trust and permissions.
AWS says each version is immutable. A later template update uses a new version, so pin and inspect the exact ARN and version used for the role.
No. It is based on observed activity, and infrequent but required permissions can appear unused. Review the workload's rare, recovery, and periodic paths before applying it.
No. AWS says those roles remain and resources continue using them. Disablement, scope reduction, replacement, and deletion are separate controlled changes.