IAM—Identity and Access Management—controls two fundamental questions in AWS: who you are and what you are allowed to do. These map directly to authentication (proving identity) and authorization (checking permissions). Understanding the distinction, and knowing when AWS issues temporary versus long-lived credentials, will help you answer a cluster of Security and Compliance questions with confidence.
Authentication, Authorization, and Credential Types
Authentication happens first. When a human user signs in to the AWS Console with a username and password, or when a CLI tool presents an access key ID and secret, AWS verifies that the identity exists and that the proof of identity is valid. Only after that does authorization begin: IAM evaluates attached policies to decide which API actions that identity may perform on which resources.
Long-lived credentials are tied to IAM users. An access key pair—an access key ID plus a secret access key—does not have an automatic expiration, but it can be deactivated, deleted or replaced, and policies can restrict its permissions. Because these keys don’t expire automatically, they require careful management: rotation, least-privilege policies, and ideally no embedding in application code. A common exam distractor is to conflate the access key with a password; they are separate credential types serving different surfaces (programmatic access versus console login).
IAM roles, by contrast, issue temporary security credentials through AWS STS (Security Token Service). A role has no permanent secret key attached to it. Instead, when a principal assumes the role, STS returns a time-limited access key ID, secret access key, and session token as a set. That set expires automatically.
For a concrete study example: imagine an EC2 instance running a backup application that needs to write objects to S3. Rather than storing a long-lived access key inside the instance, you attach an IAM role to the instance. The application calls the instance metadata endpoint, receives temporary credentials issued by STS, writes to S3, and those credentials expire within hours. No static secret lives on the server. This pattern appears in exam questions under both Security and Compliance and Cloud Technology and Services.
You can work through scenarios like this using the AWS Cloud Practitioner practice questions at Every Exam Prep—use the Security and Compliance category to focus your repetitions.
Practice Question with Explained Answer
Study example question:
A developer needs an application running on an EC2 instance to access a DynamoDB table. Which credential approach follows AWS best-practice security guidance?
- A: Create an IAM user, generate a long-lived access key, and hard-code it in the application.
- B: Attach an IAM role to the EC2 instance so the application receives temporary credentials automatically.
- C: Share the root account’s access key with the application.
- D: Store the IAM user password in an environment variable on the instance.
Correct answer: B.
Rationale: An IAM role attached to an EC2 instance lets AWS STS deliver short-lived credentials through the instance metadata service. The application retrieves them without any static secret stored in code or environment variables. Option A introduces a long-lived key that could leak. Option C violates the root-account guidance to avoid using root credentials for routine tasks. Option D confuses a console password (used for human login) with programmatic credentials and still involves a long-lived secret.
The key conceptual move is recognizing that roles eliminate the need for a human to manage key rotation for workloads because expiry is automatic.
The AWS Cloud Practitioner study guide at Every Exam Prep covers IAM alongside the other Security and Compliance topics and is publicly readable as a reference between practice sessions. When you encounter an IAM question you miss, note the specific concept—authentication versus authorization, role versus user, temporary versus long-lived—so your review targets the actual gap rather than the whole domain.
Official exam reference: AWS Cloud Practitioner exam guide. These study examples are independently written.