AWS IAM Roles and Temporary Credentials

An IAM role is an identity with permissions but no long-term password or access key. A person or service assumes the role and receives temporary credentials from AWS Security Token Service (STS), which expire automatically.

Roles are the safer choice for EC2 instances, Lambda functions, and CI pipelines. Instead of copying access keys onto a server, you attach a role and let the SDK fetch credentials.

From the command line, you can check your identity and assume a role:

bash aws sts get-caller-identity aws sts assume-role --role-arn arn:aws:iam::123456789012:role/deploy-role --role-session-name ci-session

The assume-role output contains an access key, a secret key, and a session token. Export them for the next commands:

bash export AWSACCESSKEYID=ASIA... export AWSSECRETACCESSKEY=... export AWSSESSIONTOKEN=...

For day-to-day work, configure a named profile in ~/.aws/config with rolearn and sourceprofile, then run aws s3 ls --profile deploy.

A few practices keep roles secure:

- Write trust policies that name the exact principal allowed to assume the role. - Grant only the actions the workload needs, following least privilege. - Set a short MaxSessionDuration for sensitive roles. - Review access with aws iam generate-service-last-accessed-details to remove unused permissions.