Create a role¶

A role is a machine identity within a tenant. It carries permissions through the policies attached to it, and it is used in two ways:

A running state machine executes as a role: the engine assumes it directly, with no credentials involved.
An external AWS client acts as a role by signing requests with credentials issued for it.

Creating the role and attaching a policy is the same either way, and this guide covers that. You only generate credentials (see Connect an AWS SDK or CLI) when an external client needs to act as the role; a state machine that runs as the role needs none.

Prerequisites¶

A running Stegflow instance you can sign in to (see Getting started).
A tenant. Roles and policies live inside a tenant (see Create a tenant).
Permission to manage identity in that tenant. On the tenant resource you need ListRoles and CreateRole (view and create roles) and AttachPolicy (attach a policy), plus CreatePolicy if you create a new policy. The built-in Administrators group grants these.

Steps¶

1. Create the role¶

In the console, open your tenant and create a role. Give it a name that reflects its use, for example ci-deployer or activity-worker.

2. Attach a policy to the role¶

A role carries no permissions on its own. Attach a policy that allows the actions your client calls, for example StartExecution, DescribeExecution and ListStateMachines.

Attach an existing policyCreate a new policy

Select a policy that already grants the actions you need and attach it to the role. Reuse this when several roles share the same permission set.

Create a policy that allows only the actions this role needs, then attach it. Prefer this when the role has requirements no existing policy covers.

The default role is for execution, not for clients

Every tenant ships with a default role scoped to the runtime actions an execution performs (invoking HTTP and activity tasks, starting nested executions). It is the identity a state machine runs as, not a general client identity. For a client, create a role scoped to just the API actions it calls.

Result¶

The role now carries the permissions from its attached policies. A state machine can run as it with no further setup. If an external AWS client needs to act as the role, issue credentials for it in Connect an AWS SDK or CLI.