# Ensure a support role has been created to manage incidents with AWS Support

- Source: https://support.icompaas.com/support/solutions/articles/a_1793292216432714-ensure-a-support-role-has-been-created-to-manage-incidents-with-aws-support
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that at least one IAM role in the account has the AWS managed policy AWSSupportAccess attached. This role is used by authorized people to open and manage cases with AWS Support and to use the AWS Support Center.

**Rationale**

Without a dedicated support role, opening and escalating support cases during an incident can be delayed, which can prolong outages. Teams may also fall back to using administrator accounts or the root user to contact AWS Support, which gives them far more access than needed. A dedicated role with AWSSupportAccess, whose use is restricted and monitored, supports least privilege, separation of duties and a clear audit trail of support actions.

**Impact**

-   Allows authorized staff to manage AWS Support cases without administrator or root access
    
-   Provides a clear audit trail of who assumed the role to work with AWS Support
    
-   No effect on existing workloads; only the principals allowed in the role's trust policy can use it
    

**Default Value**

No IAM role with the AWSSupportAccess policy exists by default.

**Pre-Requisites**

-   IAM permissions: iam:ListEntitiesForPolicy, iam:CreateRole and iam:AttachRolePolicy
    
-   A decision on which users or accounts may assume the support role
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the IAM console and select **Policies** in the left menu.
    
3.  Search for and select AWSSupportAccess.
    
4.  Open the **Entities attached** tab and check whether at least one role is listed.
    
5.  If no role is listed, follow the implementation steps.
    

**CLI:**

List the roles that have the AWSSupportAccess policy attached:

aws iam list-entities-for-policy --policy-arn arn:aws:iam::aws:policy/AWSSupportAccess --entity-filter Role --query "PolicyRoles\[\].RoleName"

The account fails if no role is returned. Users or groups with the policy attached do not count.

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the IAM console and select **Roles** in the left menu.
    
3.  Choose **Create role**.
    
4.  Select **AWS account** as the trusted entity type, choose **This account** (or enter the account that will assume the role) and choose **Next**.
    
5.  Search for and select AWSSupportAccess, then choose **Next**.
    
6.  Enter a role name, for example aws-support-role, and choose **Create role**.
    
7.  Allow only the people responsible for AWS Support cases to assume the role.
    

**CLI:**

Save the following trust policy as support-role-trust-policy.json, replacing <ACCOUNT\_ID> with the account whose users may assume the role:

{"Version":"2012-10-17","Statement":\[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::<ACCOUNT\_ID>:root"},"Action":"sts:AssumeRole"}\]}

Create the role:

aws iam create-role --role-name <ROLE\_NAME> --assume-role-policy-document file://support-role-trust-policy.json

Attach the AWSSupportAccess policy to the role:

aws iam attach-role-policy --role-name <ROLE\_NAME> --policy-arn arn:aws:iam::aws:policy/AWSSupportAccess

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the IAM console, select **Roles** in the left menu and select the support role.
    
3.  On the **Permissions** tab, select AWSSupportAccess and choose **Remove**.
    
4.  If the role was created only for this purpose, choose **Delete** and confirm.
    

**CLI:**

aws iam detach-role-policy --role-name <ROLE\_NAME> --policy-arn arn:aws:iam::aws:policy/AWSSupportAccess  
aws iam delete-role --role-name <ROLE\_NAME>

Note: without a support role, staff may need administrator or root access to contact AWS Support during an incident.

**Reference**

-   [https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSSupportAccess.html](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSSupportAccess.html)
    
-   [https://docs.aws.amazon.com/awssupport/latest/user/accessing-support.html](https://docs.aws.amazon.com/awssupport/latest/user/accessing-support.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/iam/attach-role-policy.html](https://docs.aws.amazon.com/cli/latest/reference/iam/attach-role-policy.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.