AWS IAM Users Vs. IAM Roles

Distinguish between IAM users and IAM roles by examining credential life cycle, identity ownership, and trust models. Apply a decision framework to select the correct identity type for compute workloads, human access, and cross-account scenarios, ensuring temporary credentials via AWS STS reduce blast radius in production environments.

We'll cover the following...

Identity ownership and credential models
- How IAM user credentials persist
- How IAM role credentials expire automatically
Why AWS prefers IAM roles
Where IAM users still fit
Decision framework for users vs. roles
Conclusion

In the previous lesson, we explored how IAM roles work through trust policies and principal entities to delegate access across AWS boundaries. This lesson answers the next logical question in secure AWS architecture design: when should we use an IAM user vs. an IAM role? Understanding this distinction directly affects how credentials flow through our systems, how blast radius is contained during a security incident, and how we design identity governance for databases, compute workloads, and human operators across our AWS environment.

An IAM user is a persistent, named identity within a single AWS account that owns long-term credentials such as a console password or access keys. An IAM role, by contrast, is an assumable identity with no permanent owner that issues temporary credentials through AWS STS each time it is assumed. Both are IAM identities, but they serve fundamentally different purposes in the request life cycle of any AWS workload.

This lesson covers identity ownership, credential life cycle mechanics, common usage patterns, and a decision framework you can apply immediately. One important clarification before proceeding: an IAM user is not the same as the AWS account root user. The root user is the account owner identity created when the account was first set up, carrying unrestricted access that cannot be limited by IAM policies.

Attention: Confusing IAM users with the root user is a common exam distractor. The root user has no IAM policy restrictions, while IAM users are fully governed by attached policies.

Identity ownership and credential models

The fundamental architectural difference between IAM users and IAM roles begins with identity ownership and extends into how credentials are issued, stored, and retired.

How IAM user credentials persist

An IAM user represents a specific person or application with a one-to-one relationship. One principal permanently owns that identity. ...