What is the difference between IAM roles, users, and policies?
Understand the difference between AWS IAM users, roles, and policies, how temporary credentials work, and how least-privilege access is enforced.
Expected Interview Answer
IAM users are long-lived identities for people or apps with permanent credentials, IAM roles are temporary identities that any trusted entity can assume for short-lived credentials, and IAM policies are JSON documents that define what actions those identities are allowed or denied.
A user has fixed credentials such as an access key or password and is best for a specific human or legacy application. A role has no permanent credentials; instead a trusted principal (an EC2 instance, Lambda function, or another account) assumes it and receives temporary security tokens, which is the preferred, safer pattern for workloads and cross-account access. Policies are attached to users, groups, or roles to grant permissions, and they are evaluated together where an explicit Deny always overrides any Allow.
- Roles avoid embedding long-lived secrets in code
- Temporary credentials rotate automatically
- Policies centralize and reuse permission definitions
- Least-privilege access is easy to enforce
- Cross-account access without sharing keys
AI Mentor Explanation
An IAM user is like a club member with a permanent membership card; a role is like the temporary captain's armband handed to whoever leads that match, granting extra authority only while worn; and a policy is the rulebook stating exactly which decisions the captain or member is allowed to make on the field.
Step-by-Step Explanation
Step 1
Create identities
Provision IAM users for humans needing console or key access, and define roles for workloads and cross-account needs.
Step 2
Write policies
Author JSON policies granting only the specific actions and resources required, following least privilege.
Step 3
Attach permissions
Attach policies to users, groups, or roles rather than embedding permissions ad hoc.
Step 4
Configure trust for roles
Define a trust policy naming which principals are allowed to assume each role.
Step 5
Assume and use roles
Have services or users call sts:AssumeRole to obtain temporary credentials scoped by the role's policies.
What Interviewer Expects
- Clear distinction between identity (user/role) and permission (policy)
- Understanding that roles issue temporary credentials
- Knowing the role trust policy versus permission policy
- Awareness that explicit Deny overrides Allow
- Preference for roles over long-lived access keys
Common Mistakes
- Saying a policy is an identity you can log in as
- Embedding a user's access keys in application code
- Confusing a role's trust policy with its permission policy
- Assuming an Allow can override an explicit Deny
Best Answer (HR Friendly)
“In AWS, an IAM user is a permanent login for a person, a role is a temporary identity that services or people can borrow for short-lived access, and a policy is the rulebook that says what each one is allowed to do. Roles are safer because they avoid permanent passwords in code.”
Code Example
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowReadOnlyS3",
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::my-app-bucket",
"arn:aws:s3:::my-app-bucket/*"
]
}
]
}Follow-up Questions
- How does an EC2 instance obtain permissions through an instance profile?
- What is the difference between a trust policy and a permission policy?
- How does policy evaluation resolve conflicting Allow and Deny statements?
- When would you use an IAM group instead of attaching policies per user?
MCQ Practice
1. Which IAM entity provides temporary credentials rather than permanent ones?
A role is assumed by a trusted principal and issues short-lived security tokens instead of permanent keys.
2. In IAM policy evaluation, what happens when an Allow and an explicit Deny both apply?
An explicit Deny always overrides any Allow during IAM policy evaluation.
Flash Cards
What is an IAM user? — A long-lived identity with permanent credentials for a person or app.
What is an IAM role? — A temporary identity that trusted principals assume to get short-lived credentials.
What is an IAM policy? — A JSON document defining allowed or denied actions on resources.
What wins in policy evaluation, Allow or explicit Deny? — An explicit Deny always overrides an Allow.