aws_iam_role cost estimation
An IAM role is completely free. IAM is a no-cost service. A role grants permissions to whatever assumes it, and the cost is whatever those services do, never the role.
An aws_iam_role is a set of permissions that an entity (an EC2 instance, a Lambda function, an ECS task, a user, or another account) can assume to make AWS API calls. IAM is a free service: roles, their trust policies, attached permission policies, and the act of assuming a role via STS all cost nothing. There is no per-role or per-assumption charge.
Because a role has no cost of its own, it is worth being precise about where cost actually comes from. A role does not create resources; it authorizes an identity to. If a role lets a Lambda write to CloudWatch Logs, the log ingestion and storage cost sits on CloudWatch, not the role. If a role lets an instance read from S3, the request and transfer cost sits on S3. The role is the permission, and the permission is free; the billed activity is whatever the authorized principal goes on to do.
There is no dollar optimization on a role. The real discipline is security scoping (least privilege), which is about blast radius, not the bill. c3x treats IAM roles as free and prices the services the role's principal actually uses, so your estimate reflects the workload rather than a phantom charge for permissions.
Terraform example
A minimal but realistic configuration that C3X can estimate.
resource "aws_iam_role" "app" {
name = "app-role"
assume_role_policy = jsonencode({
Version = "2012-10-17"
Statement = [{
Effect = "Allow"
Principal = { Service = "ec2.amazonaws.com" }
Action = "sts:AssumeRole"
}]
})
}Pricing dimensions
What you actually pay for when you provision aws_iam_role.
| Dimension | Unit | What's being charged |
|---|---|---|
| IAM role | free | The role, its trust policy, and role assumption via STS have no charge. $0 |
| Services the principal uses | varies (billed elsewhere) | Whatever the role authorizes (S3 requests, CloudWatch Logs, Lambda invocations) is billed on those services. Depends on the service |
Optimization tips
Common ways to reduce aws_iam_role cost without changing the workload.
Scope roles to least privilege
This reduces blast radius, not cost. A tight role has no cheaper price than a broad one; both are free. Scope for security, and cost tracking follows the services used.
Use roles instead of long-lived keys
Roles with temporary STS credentials are free and safer than embedding IAM user access keys. There is no cost tradeoff, only a security gain.
Watch the services a role unlocks, not the role
If a role grants write access to CloudWatch Logs or verbose S3 access, the cost to watch is that service's usage, which the role merely permits.
FAQ
Does an IAM role cost money?
No. IAM is a free service. Roles, their trust and permission policies, and assuming a role are all free. You only pay for what the services the role authorizes actually do.
Is there a charge for assuming a role or for STS?
No. Calling sts:AssumeRole and using the temporary credentials it returns is free. There is no per-assumption or per-token charge.
How many IAM roles can I create before it costs anything?
There is no cost at any count; IAM roles are always free. There are account quotas on the number of roles, but no price attached to them.
Related resources
Estimate this resource in your own Terraform
Free, open source, no API key. C3X parses your Terraform and shows line-item cost for every resource, including aws_iam_role.