IAM Role

An identity AWS uses to grant a service or person specific permissions, instead of sharing keys

Key points

• 01 A role is an identity in AWS — like a user, but no password or long-lived keys.
• 02 You attach permissions (e.g. 'can read this S3 bucket') to a role, not to a person.
• 03 Services like EC2 or Lambda assume a role to get temporary credentials.
• 04 Roles let one AWS account safely act on behalf of another without sharing secrets.
• 05 Temporary credentials expire automatically — so a leaked key has a short blast radius.
• 06 If a service is compromised, you revoke the role; you don't have to rotate keys everywhere.
• 07 Roles are the AWS-recommended replacement for hard-coded access keys in code.

Visual

flowchart LR
  U[Person or Service] -->|assumes| R[IAM Role]
  R -->|has| P[Permissions Policy]
  R -->|issues| T[Temporary Credentials]
  T -->|grant access to| AWS[AWS APIs / Resources]
  style R fill:#fff3b0,stroke:#333,stroke-width:2px

Related concepts

• Oauth Scope

  The list of permissions an app is asking for when you click 'Allow access'

  Read →

• Webhook

  A URL one service calls when an event happens, so other services can react in real time

  Read →