IAM Roles and Assuming Roles

IAM roles are one of the most powerful and widely used features in AWS security. Unlike IAM users, which have permanent credentials, roles provide temporary security credentials that automatically expire. This makes roles inherently more secure and flexible.

---

What is an IAM Role?

An IAM role is an AWS identity with specific permissions, but it has no permanent credentials (no password, no access keys). Instead, when someone or something assumes a role, AWS issues temporary security credentials — an access key ID, a secret access key, and a session token — that expire after a configurable period (from 15 minutes to 12 hours).

Think of a role as a hat you can put on. When you wear the hat, you gain its powers. When you take it off, those powers go away.

---

Why Use Roles Instead of Users?