The problem roles solve
Your app on a cloud server needs to read files from S3. How does the program prove who it is? The tempting answer is to paste an IAM user's access keys into the code or an environment file. Now a long-lived secret sits on disk, gets copied into Git, leaks into logs, and works forever for whoever steals it.
You saw this pattern with Docker: baking secrets into an image is a known mistake, you inject configuration at runtime instead. AWS takes that idea further with roles.
A role is an identity with policies but no password and no permanent keys. Instead, a trusted thing (a server, a Lambda function, a person from another account) assumes the role and receives temporary credentials that expire automatically, usually within hours.
How it looks in practice
You attach a role to a server when you launch it. Code on that server just asks the AWS SDK for credentials, and the SDK fetches short-lived keys belonging to the role. Nothing to paste, nothing to leak, and a stolen credential dies on its own within hours.
You can always ask AWS who you currently are:
aws sts get-caller-identity
{
"Arn": "arn:aws:sts::123456789012:assumed-role/photo-app-role/i-0abc123"
}assumed-role in the ARN is the tell: this program is acting as the role photo-app-role, with temporary credentials. Rule of thumb: people get IAM users, programs get roles.
Code exercise · bash
Temporary credentials carry a built-in expiry timestamp, and AWS runs this exact check on every request signed with them. Credentials were issued at time 9000 (seconds) with a one-hour lifetime, and a request arrives at time 13000. Run it, and notice why a stolen role credential is worth so much less than a stolen permanent key.
Quiz
What is the main security advantage of a role over an IAM user's access keys for code running on a server?
Problem
Code review: a teammate's server app reads S3 using an access key ID and secret pasted into a config file, which just got pushed to a public GitHub repo. After revoking the leaked key, what should the server use for S3 access instead? (One word, the IAM concept from this lesson.)