IAM User vs IAM Role
Compare long-lived AWS identities with temporary assumable permission models.
Security
IAM User
An IAM User is a long-lived identity in AWS, typically representing a person or legacy access pattern. Users often have credentials such as passwords or access keys.
Security
IAM Role
An IAM Role is an assumable identity in AWS that provides temporary credentials. Roles are widely used for services, applications, and secure short-lived access patterns.
Key Differences
IAM Users are long-lived identities, while IAM Roles are assumed temporarily and issue temporary credentials.
Roles are preferred for applications, services, and many secure access patterns, while users are increasingly limited mainly to human access scenarios or legacy cases.
Users often involve static credentials, while roles help reduce long-lived credential exposure.
Roles are central to AWS service-to-service and workload authentication patterns, while users are not the normal choice for machine workloads.
Roles are more aligned with modern least-privilege and temporary access practices.
The main difference is persistent identity versus assumable temporary identity.
When to Use
When to use IAM User
Use IAM Users only when a long-lived human identity is truly required and more modern identity federation or role-based access is not available.
When to use IAM Role
Use IAM Roles for EC2, Lambda, ECS, cross-account access, temporary privilege escalation, and most service or workload authentication patterns.
Tradeoffs
IAM Users are straightforward conceptually, but static credentials increase risk and management burden.
IAM Roles are more secure and operationally cleaner, but require understanding of assumption flows and trust relationships.
Modern AWS security best practice strongly favors roles over long-lived credentials whenever possible.
Common Mistakes
Using IAM Users for applications or automation instead of roles.
Keeping long-lived access keys where temporary credentials would be safer.
Not understanding that roles require trust relationships and assumption behavior, not just attached permissions.
Interview Tip
A strong short answer is: users are long-lived identities, roles provide temporary credentials and are preferred for workloads.