AWS roles Example Creates roles (eg saml roles) that have all the key things except the ability to change resources created by some global admin team