What is the iam:PassRole permission in AWS IAM

PassRole is a special action that is checked in addition to some other action. For example, when you create a Lambda function the PassRole is also checked.

It is listed in the reference table:

CreateFunction Dependent actions: iam:PassRole

What this means is when calling the CreateFunction API, AWS checks two permissions: the lambda:CreateFunction to make sure that the caller has permission to create Lambda functions, and also the iam:PassRole with the Role specified in the request.

Why is this needed?

This mechanism makes sure that users can only configure certain roles and not gain more permissions accidentally.

Imagine a role has access to the production database. Without the PassRole check any user who can create Lambda functions could simply upload some code, configure the production role for it, and effectively gain access to the protected resource.

PassRole prevents this: the user has no PassRole permission for that role (where the role is the resource in the policy) so it can not configure a Lambda function with it.

But because of this, PassRole is also a powerful permission: as a rule of thumb, if an identity can pass a role then its permissions are added to the identity's effective set of permission.