Cross-Service Role Generator

Setting up a role for a specific AWS service always needs two pieces done correctly together: a trust policy naming the right service principal, and a permissions policy with at least the minimum actions that service actually needs to do its job. Cross-Service Role Generator scaffolds both halves at once for six common use cases, so you start from a small, named, working shape instead of a blank IAM console form.

Pick a preset — EC2 instance role (either an SSM-managed baseline with no application permissions, or an S3-read example), Lambda execution role, ECS task role, CodeBuild service role, Glue service role, or API Gateway invoking Lambda — and the tool produces the trust policy (always {"Service": "<preset's service principal>"} as Principal, with no stray Resource field) and a starting permissions policy naming a small set of actions specific to that use case: the three CloudWatch Logs actions every Lambda function needs, the Systems Manager channel actions an SSM-managed EC2 instance needs, lambda:InvokeFunction for API Gateway, and so on.

Every preset is intentionally minimal and named for exactly what it grants — this tool does not claim these scaffolds are complete least-privilege policies for your actual workload, because it cannot know what your workload actually does beyond the baseline the AWS service itself requires. An optional Resource field lets you narrow the permissions policy from the default "*" to a specific bucket, function, or other ARN when the preset supports it (for example the S3-read EC2 example, or the API Gateway/Lambda preset).

Both documents are pretty-printed JSON with their own Copy and Download controls. Neither is deployed anywhere by this tool — you still need to create the role and attach both documents yourself, and you should review the generated actions and resources against your actual use case before doing so, since this is a scaffold to start from, not a finished, audited policy.

• Six common service-role presets in one dropdown.
• Both halves generated together — trust policy and starting permissions policy.
• Minimal, named starting actions per preset, not a blanket wildcard.
• Optional Resource override to narrow from "*" to a specific ARN.
• Trust policy correctly omits Resource, using Principal instead.
• Structural validation on both documents.
• Independent Copy/Download for each document.
• 100% client-side.

1. Pick a service-role preset from the dropdown.
2. Optionally enter a specific Resource ARN to narrow the permissions policy from its default "*".
3. Click Generate scaffold.
4. Review both JSON documents — trust policy and starting permissions policy.
5. Copy or download each and attach them to a real IAM role, after reviewing and narrowing further for your actual workload.

Example 1 — Lambda execution role. Preset "Lambda execution role" produces a trust policy trusting lambda.amazonaws.com and a permissions policy with logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents on "*".

Example 2 — EC2 with S3 read, narrowed. Preset "EC2 instance role (S3 read example)", Resource arn:aws:s3:::my-data-bucket/* — the permissions policy grants s3:GetObject/s3:ListBucket scoped to that one bucket instead of "*".

Example 3 — API Gateway to Lambda. Preset "API Gateway to invoke Lambda", Resource set to a specific function ARN — produces a trust policy for apigateway.amazonaws.com and a permissions policy scoped to lambda:InvokeFunction on that one function.

• Both trust and permissions halves in one step, avoiding the common mistake of configuring only one.
• Minimal, honestly-labeled starting points, not an over-broad default.
• Easy to narrow from "*" to a real resource ARN.
• Structural validation before you attach anything.
• Private — nothing you type leaves your browser.