AWS IAM role principal vs role session principal - amazon-web-services

Question

AWS documentation for IAM role principals[1] states the following:
To specify the role ARN in the Principal element, use the following format:
"Principal": { "AWS": "arn:aws:iam::AWS-account-ID:role/role-name" }
However, when would an IAM policy use a Principal element with an IAM role principal, as shown in the snippet? Aren't all IAM actions performed by a role identity actually performed by role session principal[2]?
For instance, the following S3 bucket policy has a Principal element with an IAM role principal
{
"Version": "2012-10-17",
"Statement": {
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::XXXXXXXXXXXX:role/MyRole"
},
"Action": "s3:ListBucket",
"Resource": "arn:aws:s3:::my-bucket",
}
}
but it does not grant access to principals who assumed MyRole. To do that rather, the policy needs to use a role session principal:
"Principal": {
"AWS": "arn:aws:sts::XXXXXXXXXXXX:role:assumed-role/MyRole/MyRoleSession"
}
Alternatively, the policy can grant access to all MyRole role sessions, regardless of session name:
{
"Version": "2012-10-17",
"Statement": {
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": "s3:ListBucket",
"Resource": "arn:aws:s3:::my-bucket",
"Condition": {
"ArnEquals": {
"aws:PrincipalArn": "arn:aws:iam::XXXXXXXXXXXX:role/MyRole"
}
}
}
}
Here, an IAM role principal is used in the Condition element. But returning to the question, is it ever applicable to use it in the Principal element?
References
IAM role principals. AWS JSON policy elements: Principal. https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-roles
Role session principals. AWS JSON policy elements: Principal. https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-role-session

Answer 1

Based on information in "Resource-based policies and implicit denies in other policy types (same account)",
Principal making the request
Resource-based policy
Identity-based policy
Permissions boundary
Session Policy
Result
Reason
IAM role
Not applicable
Not applicable
Not applicable
Not applicable
Not applicable
A role itself cannot make a request. Requests are made with the role session after a role is assumed.
It is impossible for an IAM role itself to make a request, and any policies using the IAM role principal in the Principal element
"Principal": {
"AWS": "arn:aws:iam::XXXXXXXXXXXX:role/MyRole"
}
do not apply.