IAM S3 服务角色用例

Question

I am currently still learning IAM role. As an example, I was able to create EC2 type role and attach the S3 Full Access Control policy. In that case, my EC2 instances can access S3 once the role is attached. Fairly easy to understand.

What is a use case if we select S3 as the type of trusted entity? From my understanding, the access to S3 is usually controlled by the policy. How would S3 service as trusted entity assume the role and what kind of policies could be attached to this role? Just wondering if someone could give me a use case for this. Thanks.

Answer 1

When you add a trusted entity to an IAM role that service is granted the ability to assume the IAM role.

For S3 an example of when this needs to happen is when you want to enable replication, you grant the S3 service the ability to retrieve items from a bucket and put them in another bucket.

For more information on this specific use case take a look at the Setting up permissions for replication page.