// Module included in the following assemblies:
//
// * hosted_control_planes/hcp-authentication-authorization.adoc

:_mod-docs-content-type: CONCEPT
[id="hcp-cco-aws-sts_{context}"]
= IAM roles assigned by using the CCO in a hosted cluster on {aws-short}

[role="_abstract"]
You can assign components Identity and Access Management (IAM) roles that provide short-term, limited-privilege security credentials by using the Cloud Credential Operator (CCO) in hosted clusters on {aws-first}. 

By default, the CCO runs in a hosted control plane.

[NOTE]
====
The CCO supports a manual mode only for hosted clusters on {aws-short}. By default, hosted clusters are configured in a manual mode. The management cluster might use modes other than manual.
====
