# RoleProps

Properties for defining an IAM Role.

Extends: RoleProps
Used as props by: Role

- Source: [`aws-iam/lib/role.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-iam/lib/role.ts#L62)

## Example

```ts
declare const vpc: ec2.Vpc;

const logGroup = new logs.LogGroup(this, 'MyCustomLogGroup');

const role = new iam.Role(this, 'MyCustomRole', {
  assumedBy: new iam.ServicePrincipal('vpc-flow-logs.amazonaws.com')
});

new ec2.FlowLog(this, 'FlowLog', {
  resourceType: ec2.FlowLogResourceType.fromVpc(vpc),
  destination: ec2.FlowLogDestination.toCloudWatchLogs(logGroup, role)
});
```

## Properties

- `assumedBy`: [IPrincipal](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IPrincipal.html) (required) — The IAM principal (i.e. `new ServicePrincipal('sns.amazonaws.com')`) which can assume this role.

  You can later modify the assume role policy document by accessing it via
  the `assumeRolePolicy` property.

- `description`: string — A description of the role.

  **Default:** No description.

  It can be up to 1000 characters long.

- `externalIds`: string[] — List of IDs that the role assumer needs to provide one of when assuming this role.

  **Default:** No external ID required

  If the configured and provided external IDs do not match, the
  AssumeRole operation will fail.

- `inlinePolicies`: { [key: string]: [PolicyDocument](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.PolicyDocument.html) } — A list of named policies to inline into this role.

  **Default:** No policy is inlined in the Role resource.

  These policies will be
  created with the role, whereas those added by ``addToPolicy`` are added
  using a separate CloudFormation resource (allowing a way around circular
  dependencies that could otherwise be introduced).

- `managedPolicies`: [IManagedPolicy](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IManagedPolicy.html)[] — A list of managed policies associated with this role.

  **Default:** No managed policies.

  You can add managed policies later using
  `addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName(policyName))`.

- `maxSessionDuration`: [Duration](/cdk/api/v2/docs/aws-cdk-lib.Duration.html) = Duration.hours(1) — The maximum session duration that you want to set for the specified role.

  This setting can have a value from 1 hour (3600sec) to 12 (43200sec) hours.

  Anyone who assumes the role from the AWS CLI or API can use the
  DurationSeconds API parameter or the duration-seconds CLI parameter to
  request a longer session. The MaxSessionDuration setting determines the
  maximum duration that can be requested using the DurationSeconds
  parameter.

  If users don't specify a value for the DurationSeconds parameter, their
  security credentials are valid for one hour by default. This applies when
  you use the AssumeRole* API operations or the assume-role* CLI operations
  but does not apply when you use those operations to create a console URL.

- `path`: string = / — The path associated with this role.

  For information about IAM paths, see
  Friendly Names and Paths in IAM User Guide.

- `permissionsBoundary`: [IManagedPolicy](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IManagedPolicy.html) — AWS supports permissions boundaries for IAM entities (users or roles).

  **Default:** No permissions boundary.

  A permissions boundary is an advanced feature for using a managed policy
  to set the maximum permissions that an identity-based policy can grant to
  an IAM entity. An entity's permissions boundary allows it to perform only
  the actions that are allowed by both its identity-based policies and its
  permissions boundaries.

- `roleName`: string — A name for the IAM role.

  **Default:** AWS CloudFormation generates a unique physical ID and uses that ID for the role name.

  For valid values, see the RoleName parameter for
  the CreateRole action in the IAM API Reference.

  IMPORTANT: If you specify a name, you cannot perform updates that require
  replacement of this resource. You can perform updates that require no or
  some interruption. If you must replace the resource, specify a new name.

  If you specify a name, you must specify the CAPABILITY_NAMED_IAM value to
  acknowledge your template's capabilities. For more information, see
  Acknowledging IAM Resources in AWS CloudFormation Templates.