IAM Roles Explained: Why "Switch Role" Fails (And How to Fix It) | AWS Hands-On #04

"No one learns how to swim by reading about water"- Please don't just watch: build ▶ AWS Hands-On Lessons for Beginners — Episode 4 ◀ Previous: IAM users & groups → https://youtu.be/oCXQa5hXg_c 📚 Full course (updated as new lessons publish) → https://www.youtube.com/playlist?list=PLV6bFfc-yYjE 💻 Code for this lesson → https://github.com/lightcloud99/AWS-Cloud-Engineering-for-Beginners/blob/main/aws-iam/sts-assume-role.json Today we create an IAM role, configure its trust policy, and watch a brand-new user assume it live. We'll also hit a real "switch role" failure on camera — the exact error most beginners get — and fix it step by step. By the end you'll understand the difference between authentication and authorization, and why roles are how AWS grants power without giving it away permanently. 💻 CODE FOR THIS LESSON sts:AssumeRole inline policy → https://github.com/lightcloud99/AWS-Cloud-Engineering-for-Beginners/blob/main/aws-iam/sts-assume-role.json All course code → https://github.com/lightcloud99/AWS-Cloud-Engineering-for-Beginners ⏱️ TIMESTAMPS 00:00 What we're building today 00:27 What is an IAM role? 00:32 IAM user vs IAM role — the key difference 01:10 Real examples of roles in use 01:27 Trust policy vs permissions policy 02:23 What actually happens when you assume a role (STS) 03:05 Why not just give users permissions directly? 03:36 Machines can't have passwords 03:57 Cross-account access without sharing credentials 04:30 Today's plan 05:10 DEMO: Creating the user John 05:58 Creating a user with NO permissions on purpose 06:29 Signing in as John — access denied everywhere 06:54 Authentication vs authorization explained 07:41 Creating the EC2 role 07:57 Choosing a trusted entity 08:17 Same account vs another account (+ the MFA option) 08:48 Attaching AmazonEC2FullAccess 09:43 Reading the trust policy JSON 10:47 Using the Switch Role button 11:35 ❌ "Check your information" — why switch role fails 11:58 The fix: an inline sts:AssumeRole policy 12:44 Finding and using the role ARN 14:00 ✅ Switching role successfully 14:33 Proving EC2 access now works 15:09 Testing ECR — still denied (least privilege in action) 15:27 Switching back and losing the permissions again ⚠️ THE #1 MISTAKE A role's trust policy says who MAY assume it — but the user also needs their own permission to make the sts:AssumeRole call. Both sides must agree. Miss the user side and you get "Check your information or contact your administrator." 📌 USING THE POLICY FILE Copy the JSON from the link above, then replace the Resource ARN with your own role's ARN you'll find it on the role's summary page in IAM. It looks like: arn:aws:iam::123456789012:role/EC2-Role 💡 WHY THIS MATTERS LATER Every Lambda function and EC2 instance in the rest of this course acts on your behalf by assuming a role. Learn it here with a human user and the machine version will feel familiar. 📚 WHAT'S NEXT Episode 6: Launching your first EC2 instances — Linux and Windows, side by side. 👉 Subscribe for the next lesson: https://www.youtube.com/@LightCloud9?sub_confirmation=1 ⭐ Star the repo if you find it useful it helps others discover the course. 💬 Stuck on a step? Drop a comment I read and reply to all of them. Teaching AWS the way I wish it had been taught to me hands-on, one project at a time. — Uche Ugochukwu | Light Cloud #AWS #IAM #IAMRoles #CloudSecurity #AWSTutorial #LearnAWS #AWSForBeginners #AWSCloudPractitioner