In my AWS console (IAM -> Access Management -> Roles), I noticed a service-linked role among the list of all the roles.
How do I determine what AWS resources can assume this service-linked role. I'm asking because I'm auditing a system and trying to get a handle on what permissions may be in use elsewhere. Someone (don't know who) created it for a reason. I'd like to figure out why.
How can I tell what is using this service-linked role?
Service Linked roles are by-design used by one particular AWS service.
In the AWS Management Console for the IAM service, you can click on a role and view the "Summary". The summary contains a path attribute which looks like the following: /aws-service-role/access-analyzer.amazonaws.com/.
In this example you can see that the service which uses this role is called Access Analyzer.
You can get information on the Service-Linked role for that particular service in the docs. [1]
Navigate to section "Security, Identity, and Compliance Services" -> search for row "IAM Access Analyzer" and click on the link Yes in the "Service-linked roles" column of the table. The linked docs usually tell you why AWS sets up this particulal service linked role and which permissions it includes.
General information about service linked roles is given by the IAM docs on "Service-Linked Roles" [2] and the IAM "Troubleshooting" guide [3].
If you want to know when a particular service linked role was last used in your account, use the Access Analyzer [4].
There are currently 3 posts on the topic service linked roles from the AWS official blog [5]. Two of them are probably related to your question:
The blog post "Greater Transparency into Actions AWS Services Perform on Your Behalf by Using AWS CloudTrail " [6] goes into detail how to monitor the actions which are performed by the role. This is the procedure also suggested by @jellycsc's answer I guess.
Excerpt from the blog post [6]:
In this blog post, I demonstrate how to view CloudTrail logs so that you can more easily monitor and audit AWS services performing actions on your behalf. First, I show how AWS creates a service-linked role in your account automatically when you configure an AWS service that supports service-linked roles. Next, I show how you can view the policies of a service-linked role that grants an AWS service permission to perform actions on your behalf. Finally, I use the configured AWS service to perform an action and show you how the action appears in your CloudTrail logs.
The blog post "Now Use AWS IAM to Delete a Service-Linked Role When You No Longer Require an AWS Service to Perform Actions on Your Behalf" [7] makes the following statement:
When you delete a service-linked role, the linked service no longer has the permissions to perform actions on your behalf. To ensure your AWS services continue to function as expected when you delete a service-linked role, IAM validates that you no longer have resources that require the service-linked role to function properly. This prevents you from inadvertently revoking permissions required by an AWS service to manage your existing AWS resources and helps you maintain your resources in a consistent state. If there are any resources in your account that require the service-linked role, you will receive an error when you attempt to delete the service-linked role, and the service-linked role will remain in your account. If you do not have any resources that require the service-linked role, you can delete the service-linked role and IAM will remove the service-linked role from your account.
[1] https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html#admin_svcs
[2] https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#create-service-linked-role
[3] https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_roles.html#troubleshoot_roles_new-role-appeared
[4] https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_access-advisor.html?icmpid=docs_iam_console
[5] https://aws.amazon.com/de/blogs/security/tag/service-linked-roles/
[6] https://aws.amazon.com/de/blogs/security/get-greater-transparency-into-actions-aws-services-perform-on-your-behalf-by-using-aws-cloudtrail/
[7] https://aws.amazon.com/de/blogs/security/now-use-aws-iam-to-delete-a-service-linked-role-when-you-no-longer-require-an-aws-service-to-perform-actions-on-your-behalf/
