CreateRole

17 Sep 2026

Print
Dark
Light

CreateRole

Updated on 17 Sep 2026

Print
Dark
Light

Article summary

Did you find this summary helpful?

Thank you for your feedback

Post

/#/CreateRole

Availability
Early Access: July 1, 2026
Early Access is gated; contact the Backblaze Sales team for access.
Limited Availability: July 1, 2026
This API is available only to customers with access to the Backblaze Enterprise Web Console. For more information, contact the Backblaze Sales team.

Create a role with a trust policy

Actual request: POST / to iam.backblazeb2.com with Action=CreateRole in the form-encoded body.

Request parameters

Parameter	Type	Required	Description
Action	string	yes	CreateRole
Version	string	yes	2010-05-08
RoleName	string	yes	Friendly name of the role (up to 64 characters).
AssumeRolePolicyDocument	string	yes	URL-encoded trust policy JSON (up to 131,072 characters after decoding).
Path	string	no	Path prefix for the role (up to 512 characters).

Unsupported AWS IAM parameters

Description, MaxSessionDuration, PermissionsBoundary, Tags.member.N.

Example response

 <CreateRoleResponse xmlns="https://iam.amazonaws.com/doc/2010-05-08/">
  <CreateRoleResult>
    <Role>
      <Path>/service/</Path>
      <RoleName>analytics-role</RoleName>
      <RoleId>AROAEXAMPLE123456789</RoleId>
      <Arn>arn:aws:iam::123456789012:role/service/analytics-role</Arn>
      <CreateDate>2026-02-03T21:10:00Z</CreateDate>
      <AssumeRolePolicyDocument>{...}</AssumeRolePolicyDocument>
    </Role>
  </CreateRoleResult>
  <ResponseMetadata>
    <RequestId>req-1234567890</RequestId>
  </ResponseMetadata>
</CreateRoleResponse>

Errors

EntityAlreadyExists
ValidationError
MalformedPolicyDocument
LimitExceeded

Security

API Key: sigv4

Header parameter nameAuthorization

AWS Signature Version 4. The Authorization header takes the form AWS4-HMAC-SHA256 Credential=..., SignedHeaders=..., Signature=.... For IAM and STS requests, the signing region is not validated; use any non-empty region value consistently. The signing service must be iam for IAM requests and sts for STS requests. When using temporary credentials, also include X-Amz-Security-Token: <session-token>.

Body parameters

object

Action

string Required

Valid values[ "CreateRole" ]

Version

string Required

Valid values[ "2010-05-08" ]

RoleName

string Required

Max length64

AssumeRolePolicyDocument

string Required

URL-encoded trust policy JSON.

Path

string

Max length512

Example/service/

Responses

200

The request succeeded. The response body is an XML document specific to the Action invoked, with a ResponseMetadata block containing a RequestId.

string

Action-specific XML response. See the example response for each operation.

400

The request was malformed or failed validation.

HTTP Status	Code	Description
400	ValidationError	Invalid input parameter or failed validation.
400	MalformedPolicyDocument	Policy JSON is invalid or unsupported.

string

403

The caller is not authorized. For operations that reference IAM resources, authorization may be evaluated before resource existence is disclosed.

HTTP Status	Code	Description
403	AccessDenied	The authenticated principal lacks permission for this action.

string

409

The resource already exists or a quota was exceeded.

HTTP Status	Code	Description
409	EntityAlreadyExists	Resource already exists.
409	LimitExceeded	Quota or size limit exceeded.

string

429

The request was rate-limited.

HTTP Status	Code	Description
429	Throttling	Too many requests. Use exponential backoff.

string

500

The server encountered an unexpected condition.

HTTP Status	Code	Description
500	InternalFailure	Unexpected server error.

string

Was this article helpful?

What's Next

ListRoles (GET)