Amazon GameLift Streams now supports assigning an IAM role to a stream session

Amazon GameLift Streams now supports assigning an IAM role to a stream session, enabling your application to securely access AWS resources such as Amazon S3 buckets and DynamoDB tables. Simply pass a RoleArn parameter when starting a stream session — your application automatically receives short-lived, auto-refreshing credentials through the standard AWS SDK credential resolution chain, with no application code changes required.

Key benefits:

• No more long-lived credentials — eliminate the risk of embedded access keys being exposed in application bundles or environment variables
• Automatic credential rotation — credentials are short-lived and refresh automatically, reducing operational burden
• Fail-fast validation — role misconfigurations are caught at session start with clear error messages, not silently during runtime
• Zero code changes — credentials are delivered via the standard AWS SDK credential resolution chain

Previously, customers who needed their streamed applications to access AWS services had to embed long-lived access keys in application bundles or pass them as environment variables, creating security and operational challenges. Now, Amazon GameLift Streams handles credential vending and automatic refresh using the same container credential provider mechanism trusted by Amazon ECS task roles and Amazon EKS Pod Identity.

You can also configure IAM roles directly in the Amazon GameLift Streams console, which provides a pre-filled trust policy template to simplify role setup — no need to hand-craft IAM trust policies.

IAM role support for stream sessions is available today in all AWS Regions where Amazon GameLift Streams is available.

Check out the Session Credentials Setup guide in the Amazon GameLift Streams Developer Guide to get started.