IAM Role

An IAM Role is an AWS identity that you create with specific permissions but without permanent credentials. Instead of being associated with a single person, a role can be assumed by anyone or anything that needs it - an EC2 instance, a Lambda function, a user in another AWS account, or even an external identity provider.

When a principal assumes a role, AWS Security Token Service (STS) issues temporary credentials (access key, secret key, and session token) that expire automatically. This is fundamentally more secure than long-term access keys because there is nothing to leak or rotate.

Common Use Cases

• EC2 Instance Roles: give applications on EC2 access to AWS services without embedding credentials
• Cross-Account Access: allow users in Account A to access resources in Account B
• Lambda Execution Roles: define what AWS services a Lambda function can call
• Federation: let users from an external IdP (Okta, Azure AD) assume a role via SAML or OIDC

Security Best Practices

• Always prefer roles over long-term access keys
• Use condition keys to restrict who can assume the role (e.g., aws:SourceIp, aws:PrincipalOrgID)
• Set the maximum session duration to the minimum needed
• Use external ID for cross-account roles to prevent the confused deputy problem