What an IAM Role Really Is

An IAM role is an identity you can assume to receive a set of permissions, but unlike a user it has no permanent credentials. Instead, when an entity assumes a role, AWS issues temporary security credentials that expire after a set time. Roles are the secure, modern way to grant access on AWS and appear throughout the SCS-C02 exam.

Every role has two policy parts:

• A trust policy (also called the assume-role policy) that says who is allowed to assume the role.
• One or more permission policies that say what the role can do once assumed.

This separation is the heart of how roles enable secure delegation: you decide who may borrow the identity and, separately, what that identity may do.