---
title: "Configuring IAM roles in AWS"
slug: "configuring-iam-roles-in-acctaccess"
updated: 2026-09-08T11:25:04Z
published: 2026-09-08T11:25:04Z
canonical: "docs.britive.com/configuring-iam-roles-in-acctaccess"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.britive.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuring IAM roles in AWS

Each IAM role that you want to make available in Britive must allow the account access manager service to assume it. Unlike an AWS or AWS Identity Center application, this application type does not use SAML for the role that is checked out. The role requires no Britive identity provider entry and no SAML conditions.

Add the following statement to the trust policy of each role:

```json
{
  "Effect": "Allow",
  "Principal": { "Service": "account-access.amazonaws.com" },
  "Action": ["sts:AssumeRole", "sts:SetContext"],
  "Condition": {
    "StringEquals": {
      "aws:SourceAccount": "<management-account-id>",
      "aws:SourceArn": "<account-access-manager-arn>"
    }
  }
}
```

- Both *sts:AssumeRole* and *sts:SetContext* are required.
- *sts:SetContext* allows the account access manager to attach the IAM Identity Center identity context to the session. A role whose trust policy omits either action is discovered during a scan but cannot be added to a profile.

Roles are configured per account. Scan each AWS account whose roles you intend to grant.

## Creating an IAM Policy in AWS

If AWS Identity Center is not integrated with Britive, you need to create an IAM policy and role in AWS. For more information, see [Creating IAM Roles in AWS](/v1/docs/configuring-iam-roles-in-awsidentitycenter).