IAM Roles Cannot Be Attached to IAM Groups

An IAM role cannot be attached to an IAM group. The restriction follows from what each of the two things is.

A role is assumed. Assuming a role means an authenticated entity temporarily takes on that identity and receives a distinct set of temporary credentials for the session. That requires something that can make a request and hold credentials.

A group is neither of those. It is a container for users and a place to attach policies to several of them at once. It never makes a request, never holds credentials, and cannot be named as a principal in a policy, because principals are authenticated entities and a group is not one.

The pattern that achieves the same thing

Attach a policy to the group that permits its members to assume the role. Each member then assumes the role individually, as themselves.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::123456789012:role/DeploymentRole"
        }
    ]
}

Every user in the group can now call sts:AssumeRole for DeploymentRole and receive temporary credentials. Membership of the group is what confers the ability, so adding and removing people works exactly as it would if the role could be attached directly.

The role’s own trust policy has to permit it from the other side:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::123456789012:root"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "Bool": {
                    "aws:MultiFactorAuthPresent": "true"
                }
            }
        }
    ]
}

Both sides are required: the group policy allows the call, and the trust policy accepts it.

Why the indirection is worth having

The pattern is better than direct attachment would be. Each assumption is an individual CloudTrail event with a session name, so activity is attributable to a person rather than to a group. The session expires. Conditions on the trust policy — MFA present, a source network, a time window — apply at the moment of assumption rather than being a standing grant. And elevated permissions are held only while they are being used.

Where IAM Identity Center is in use, this is the same shape with the plumbing supplied: a group is assigned a permission set, which provisions a role in each account, and members receive short-lived credentials for it through the access portal.