Roles and service accounts

Service accounts

A service account is an identity for a program: a CI pipeline, a backup job, a deploy script. It has policies and access keys like a user, but no password and no console sign-in.

SA=$(tebib -o json iam service-account create ci --description "GitHub Actions deploys" | jq -r .id)
tebib iam attachment attach --policy ProjectMember --principal "service-account/$SA" --project p-0123456789ab
tebib key create --service-account "$SA" --description "GitHub Actions" --expires 2027-01-31T00:00:00Z

Service-account keys may be made to never expire (--never-expires), but only by someone with iam:CreateNonExpiringAccessKey (owners have it). Prefer expiring keys and rotate them.

Turn a service account off with tebib iam service-account update <ID> --disable to stop all its keys at once; deleting it deletes its keys.

Roles

A role has policies but no long-lived keys. A trusted principal assumes the role and gets temporary credentials (a key ID starting TBS and a secret) that expire on their own.

Use a role to:

• give people elevated access only when they need it, with their own identity in the audit log;
• give CI credentials that expire within the hour;
• keep powerful permissions off everyday keys: the key can only assume the role, and each session is short and named.

Create a role

The trust policy says who may assume it:

trust.json

{
  "Version": "2026-10-08",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "Tebib": "trn:tebib:iam::o-0123456789ab:user/*" },
      "Action": "iam:AssumeRole",
      "Condition": { "IpAddress": { "auth:source-ip": ["203.0.113.0/24", "2001:db8:1234::/48"] } }
    }
  ]
}

This one lets any user of the organization assume the role, from the office or VPN ranges only. auth:mfa is always false for access keys, so don’t require it in a trust policy you want to use from the CLI.

ROLE=$(tebib -o json iam role create deployer --trust-policy trust.json --max-session 3600 | jq -r .id)
tebib iam attachment attach --policy ProjectAdmin --principal "role/$ROLE" --project p-0123456789ab

Sessions last from 15 minutes to 12 hours (--max-session 900 to 43,200 seconds; default 1 hour). A session started from another role’s session lasts at most an hour.

Assume it

eval "$(tebib role assume "$ROLE" --session-name amina --export)"     # this shell only
tebib role assume "$ROLE" --session-name amina --save-profile deployer # or as a profile
tebib --profile deployer vm list

Pass --policy session.json to narrow the session further than the role allows. The session name shows in the audit log next to the role and the person who assumed it.

End every open session of a role at once, for example after a leak:

tebib iam role revoke-sessions "$ROLE"

Which to use

Need	Use
A person working day to day	Their own user, with group policies
A person doing something risky now and then	A role they assume, with MFA in the trust policy
A long-running program	A service account with an expiring, network-restricted key
A pipeline that should hold credentials only briefly	A service account trusted by a role: the pipeline’s key only assumes the role, and the role’s session does the work for an hour

Cap what any of them can ever get with a permission boundary.