Key points

• Prefer roles and federation with temporary credentials; tightly limit IAM users and long-term keys.
• Role trust controls who may assume; permission policies control allowed actions; explicit denies and boundaries can further restrict.
• Least privilege must name required actions, resources, and conditions and be refined from actual use.

Best-known use cases

• Give workloads role-based access to AWS services.
• Delegate cross-account access with temporary sessions.

What candidates often confuse it with

• IAM users are persistent identities; roles provide temporary sessions for workloads/federation.
• Identity policies grant to principals; supported resource policies grant at resources; SCPs only cap permissions.

Key takeaway

Choose the principal and trust model first, then build least-privilege temporary authorization.

Related services

• AWS IAM Identity Center
• AWS Organizations
• AWS Secrets Manager

Relevant exam tasks

• D1.1
• D1.2
• D1.3

Learn more

• IAM