Cornell AWS account owners can create custom AWS IAM roles and have them linked to Cornell AD so that users with Cornell netids can use Shibboleth to authenticate to AWS and be granted to privileges in the custom role.Cornell AWS account administrators already take advantage of this capability when they use Shibboleth to login to the AWS console.