> For the complete documentation index, see [llms.txt](https://docs.wellcomecollection.org/aws-account-setup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.wellcomecollection.org/aws-account-setup/users-iam-roles-accounts-and-so-on/what-is-an-initial-role.md).

# What is an initial role?

An **initial role** is the first IAM role that users assume when they log into our AWS estate. It is represented by a permission set in the AWS Identity Center.

{% @mermaid/diagram content="flowchart LR
L\[User logs in<br/>through AWS Identity Center] --> IR\[User assumes<br/>an <strong>initial role</strong>]
IR --> SR\[User assumes a<br/>more specific role]
SR --> DS\[User can do stuff<br/>inside AWS]

```
classDef externalNode fill:#e8e8e8,stroke:#8f8f8f
class L,SR,DS externalNode

classDef initialRole fill:#ffebad,stroke:#ffce3c,stroke-width:2px
class IR initialRole" %}
```

This initial role can't do anything except assume a more specific IAM role. It's a "stepping stone" into AWS.

## Which initial role do you use?

The initial roles are handled by [AWS Identity Center configuration](https://github.com/wellcometrust/wellcomeorganisation-infra/blob/master/data.tf) for the Platform AWS account.

This is terraformed in the `wellcomeorganisation-infra` repository, in the Wellcome Trust GitHub organisation.

![A table of groups in the Identity Center. Each group has a name (for example, 'RG\_WC\_Digirati\_Developer') and a list of users assigned (for example, 'digirati-dev, azure\_sso-saml\_provider').](https://936025594-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7dVJDenRIYE4OqItUioP%2Fuploads%2Fgit-blob-d30c55ecbb6ebba638b0f612f3a7cff3a51d5dc0%2Fidentity_center_groups.png?alt=media)

Everybody who can log into our AWS estate is a member of at least one of these groups.

Groups can be associated with permission sets, which applies IAM policies in a particular AWS account.

![A table of permission sets in the Identity Center.').](https://936025594-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7dVJDenRIYE4OqItUioP%2Fuploads%2Fgit-blob-d290188dabd0d4a1e51d6ac1bbfcb8c9bdf7d2fd%2Fidentity_center_permission_sets.png?alt=media)

When you log in to AWS, your initial permissions set is determined by the role you choose at the Identity Center login screen.

![The identity center login screen with examples of differeing permission sets').](https://936025594-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7dVJDenRIYE4OqItUioP%2Fuploads%2Fgit-blob-d290188dabd0d4a1e51d6ac1bbfcb8c9bdf7d2fd%2Fidentity_center_permission_sets.png?alt=media)

## Examples

1. Suppose you're a member of the `RG_WC_Digital_Platform_Lead` group. A permission set assigned to this group is `weco-developer`.

   There is only one choice of role, so when you log in to AWS, you're logged in using the `weco-developer` role.
2. Suppose you're a member of the `RG_WC_Digital_Platform_Lead` and `RG_WC_Digital_Artefactual` groups. The initial roles assigned to these groups are `weco-developer` and `weco-artefactual-developer`.

   When you log in to AWS via Identity Center, you'll be offered a choice between these two roles.