Roles

Learn AWS IAM roles for temporary credentials, service permissions, cross-account access, federation, and secure application access.

Last reviewed: June 2026

·AWS CloudAWS CLI v2AWS SDKsAWS Well-Architected Framework
✅
Quick Understanding: Roles helps teams design, build, secure, operate, and troubleshoot AWS workloads. In enterprise projects, the important questions are ownership, blast radius, automation, observability, compliance, and cost.

🔍 What Is It?

An IAM role is an identity with permissions that can be assumed by trusted principals.

Roles do not have permanent passwords or access keys. They provide temporary credentials through AWS Security Token Service.

🎯 Why Do We Need It?

Roles reduce the need for long-lived credentials. They let EC2, Lambda, ECS, CodeBuild, and users access only what they need for a limited time.

Roles are central to cross-account access and enterprise federation.

Common developer mistakes:

  • →Choosing defaults without checking security, cost, or failure behavior
  • →Treating AWS services as isolated tools instead of part of an architecture
  • →Skipping tags, alarms, IAM review, backups, and runbooks until production incidents happen
  • →Building manually in the console and then struggling to reproduce environments

🏗️ What Happens in Real Projects?

A production EC2 instance profile lets an orders API read from a specific S3 bucket and write logs to CloudWatch. The instance never stores an access key.

A DevOps engineer signs in through SSO and assumes a deployment role in the staging account for a short session.

⚙️ How It Works

A role has a trust policy and permission policies.

The trust policy says who can assume the role. The permission policies say what the role can do after assumption. Temporary credentials expire and are rotated automatically for AWS service roles.

💻 Example

Role trust and permission model — A simplified service role design.

text
Role: orders-api-role
Trusted by: EC2 service
Permissions:
  - s3:GetObject on company-orders-config/prod/*
  - logs:PutLogEvents to application log group
  - kms:Decrypt for one application key
Attached to: EC2 instance profile
Credential type: temporary credentials

🤔 Common Confusions

❓ Is a role the same as a user?

No. A user is a long-term identity. A role is assumed temporarily by a trusted principal.

❓ What is a trust policy?

A trust policy defines who is allowed to assume the role.

❓ Can roles be used across accounts?

Yes. Cross-account role assumption is a standard enterprise pattern.

🚨 Common Production Issues

**Trust policy too broad** allows unintended principals to assume powerful roles.

**Permission policy too broad** turns service roles into lateral movement paths.

**No session controls** makes privileged access hard to trace.

**Using access keys instead of roles** creates avoidable credential leakage risk.

✅ Best Practices

Use roles for AWS service access

Use cross-account roles instead of shared users

Keep trust policies narrow

Use external IDs or conditions for third-party access

Set session duration appropriately

Monitor role assumption in CloudTrail

🏛️ Architect's Note

Senior Architect's Perspective

Roles are how mature AWS environments avoid permanent secrets. The trust policy is as important as the permission policy; one controls who gets in, the other controls what they can do.

💬 Frequently Asked Questions

Interview: How would you explain Roles in a real AWS project?

Roles should be explained through the business workload it supports, the AWS responsibility boundary, the failure modes, the security controls, and how it is monitored and automated.

Interview: What production mistake do developers commonly make with Roles?

The common mistake is using the service successfully in a lab but not designing for least privilege, multi-AZ resilience, alarms, cost visibility, and repeatable infrastructure.

What is an instance profile?

An instance profile is the container used to attach an IAM role to an EC2 instance.

Can Lambda use an IAM role?

Yes. Every Lambda function runs with an execution role that grants permissions to AWS services.

🎯 Key Takeaways

1Roles provide temporary credentials
2Trust policy defines who can assume the role
3Permission policies define what the role can do
4Roles are preferred over long-lived access keys

🎯 Practice this topic in interviews

↗ Where this topic fits

Sources

Sources / References

Use these AWS references to verify the concept in official docs and continue into the most relevant SplashRide pages.