Add a Custom Cloud Access Role

Last updated: October 22, 2026

In this role, you enter a custom trust policy to define who has access under which circumstances. This option supports all AWS trust policy options. For information on creating trust policies, see Amazon's documentation.

These accounts are AWS specific.

When you create a cloud access role on an OU, it will be available on all descendant resources. Inherited cloud access roles are unique in that they are not affected by cloud rules applied on descendant resources. This allows you to apply consistent controls across the organization. For more information, see Cloud Access Role Inheritance and Exemption.

Note: You will need to add an account to at least one project before you can create a cloud access role. For information on adding accounts to projects, see Add an Account or Attach an Account in the Account Cache to a Project.

To add a custom cloud access role to a resource:

  1. Navigate to OUs > All OUs or Projects > All Projects.

  2. Click the name of the OU or project.

  3. Select the Identity tab.

  4. Select the Cloud Access Roles subtab.

  5. Click the Add button.

  6. Under Select the type of Cloud Access Role you would like to create, select Custom Cloud Access Role.

  7. Enter a name for the role.

  8. Click Continue.

  9. If you are creating a project cloud access role, select one or more cloud providers for the role. The role will only be able to access accounts belonging to the selected cloud providers.

  10. If you are creating a project cloud access role, select the accounts to apply the role to in the AWS Accounts field.

  11. (Optional) Enter the name of the AWS IAM role that will be created in the AWS accounts attached to the project. This is the name of the role that will display in the top right of the AWS console. It will display as: rolename/username. Any value in the gray box is a prefix that is set at the global level and cannot be edited here. For information on changing this prefix, see AWS Access. If you leave this blank, Kion generates a name based on the cloud access role name.

  12. (Optional) Enter an AWS IAM Path. If you are using the IAM API or AWS Command Line Interface (AWS CLI) to create IAM resources, this field can be used when granting permissions. For more information, see the Friendly Names and Paths section of the AWS user guide.

  13. (Optional) Select AWS IAM Policies to associate with this role. These allow console access for AWS.

  14. (Optional) Select AWS Permissions Boundaries to associate with this role.

  15. (Optional) Click + Add Key/Value Pair to add AWS session tags to this role. When you federate in to an account using this role, these session tags are used to determine what permissions you have. You must set up IAM policies that leverage session tags in AWS before adding them to Kion. For more information, see Amazon's article: Rely on attributes to create fine-grained permissions in AWS.

  16. Enter the JSON for your Custom Trust Policy. For information on creating trust policies, see Amazon's documentation.

  17. If you are creating a project cloud access role, choose an option under Apply this Cloud Access Role to Future Accounts. Yes, apply to future accounts. is selected by default and automatically applies this cloud access role to accounts that are added to this project in the future. Select No, do not apply to future accounts. to apply the role only to the accounts you selected.

  18. Click Create Cloud Access Role.