> For the complete documentation index, see [llms.txt](https://docs.wellcomecollection.org/aws-account-setup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.wellcomecollection.org/aws-account-setup/users-iam-roles-accounts-and-so-on/what-are-our-standard-roles.md).

# What are our standard roles?

Within each account, we create a standard set of roles.

Each role name is made up of two parts: the name of the account, and the role suffix. For example, `workflow-developer` has the account name `workflow` and the role suffix `developer`.

This is a list of our standard roles:

| role suffix | example role            | what it allows                                                                                                                                 |
| ----------- | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
| admin       | workflow-admin          | Complete access to the account. This is a superuser role that can do anything.                                                                 |
| developer   | platform-developer      | Complete access, bar a handful of destructive actions (e.g. deleting S3 buckets). This also doesn’t allow configuring IAM users.               |
| read\_only  | digitisation-read\_only | Provides read-only access to most of the account. This doesn't include access to secrets in Secrets Manager.                                   |
| ci          | identity-ci             | Provides the permissions that CI needs to do things in this account (e.g. publishing Docker images to ECR). Usually used by CI instances only. |