EasyExperience level: 0-2 years · 3-5 years1 min read

IAM users vs roles vs policies — how do you grant an app access to AWS without hardcoding keys?

Reviewed by Gurusankar M.

Asked inAmazonTCSCognizantWipro
#iam#roles#policies#least privilege#credentials
Report issue

Short Answer

A user is a long-lived identity with credentials (for humans). A role is an identity apps/services ASSUME to get temporary credentials — no stored keys. A policy is the JSON that grants permissions. Give EC2/Lambda an IAM role, never embed access keys.

On this page

Concept Made Simple

Coffee Chat Question

“IAM users vs roles vs policies — how do you grant an app access to AWS without hardcoding keys?”

Remember It Faster

Mind Map Answer

User
long-lived identity (humans/CI)
Role
assumed → temporary creds (apps)
Policy
JSON permissions (allow/deny)

Learn by Doing

Hands-on Keyboard

json
{ "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["s3:GetObject"],
    "Resource": "arn:aws:s3:::my-bucket/*"
  }] }

Think Beyond the Expected

What If?

Why is attaching an IAM role to EC2/Lambda better than storing an access key in config?

A role delivers short-lived, auto-rotating temporary credentials via the instance/execution environment — nothing to leak or rotate manually. Hardcoded keys get committed to repos, logged, and never expire, which is a top cause of AWS breaches.

Real World

Leaked long-lived access keys (in git) are one of the most common AWS security incidents; roles + least-privilege policies are the standard, credential-free way to grant access.

Interviewer's Expectation

Keywords they're listening for:

  • user vs role vs policy
  • roles = temporary creds
  • attach role to service
  • least privilege
  • no hardcoded keys

Common Mistakes

  • Hardcoding access keys in code/config
  • Over-broad policies (Action: '*')
  • Using the root account for daily work

Best Practices

  • Use roles for services; least-privilege policies
  • No long-lived keys in apps
  • Lock down and MFA the root account

Follow-up Questions

  1. What is least privilege and how do you achieve it?
  2. How do temporary credentials from a role rotate?
  3. Difference between identity-based and resource-based policies?

Continue Learning with AI

Take this question deeper with your favourite AI assistant. Pick a depth, copy the prompt, or open it directly — AI is your learning companion, not a shortcut.

Plain-language foundations

I'm preparing for a software engineering interview and want to understand this from scratch, as a beginner.

Topic: IAM (AWS)
Interview question: "IAM users vs roles vs policies — how do you grant an app access to AWS without hardcoding keys?"

Please:
1. Explain the core idea in simple, plain language, using an everyday analogy.
2. Define any technical terms you use.
3. Walk through one small, concrete example.
4. Finish with a single sentence I can easily remember.

Keep the tone friendly and assume I'm new to this topic.
Open inChatGPTGeminiClaude

Was this answer helpful?

Affiliate links

Tools for Your Developer Workspace

Equipment for a comfortable, productive setup.

As an Amazon Associate I earn from qualifying purchases.