Key points

• Roles provide temporary workload and delegated identity without embedded long-term credentials.
• Identity policies control principal permissions; role trust policies control role assumption.
• Least privilege scopes actions, resources, and conditions to the application need.

Best-known use cases

• Authorize a Lambda or container workload to call AWS services.
• Define and troubleshoot role assumption and cross-service access.

What candidates often confuse it with

• IAM/STS governs AWS principal sessions; Cognito governs application-user identity flows.
• Trust answers who may assume a role; permissions answer what the session may do.

Key takeaway

Use scoped roles and distinguish principal permissions from role trust and resource authorization.

Related services

• AWS Security Token Service (AWS STS)
• Amazon Cognito
• AWS Key Management Service (AWS KMS)

Relevant exam tasks

• D2.1 — Implement authentication and/or authorization for applications and AWS services
• 2.1.1 — Use an identity provider to implement federated access (for example, Amazon Cognito, IAM)
• 2.1.3 — Configure programmatic access to AWS
• 2.1.4 — Make authenticated calls to AWS services
• 2.1.5 — Assume an IAM role
• 2.1.6 — Define permissions for IAM principals
• 2.1.8 — Handle cross-service authentication in microservice architectures

Learn more

• AWS Identity and Access Management (IAM)