AWS IAM Roles, Policies, and Access Mechanisms

Ashutosh Kumar JhaJanuary 25, 2026

AWS Access Management Overview

AWS IAM provides secure, fine-grained access control for humans, AWS services, and external applications. Access is granted through IAM users, roles, and policies, with temporary credentials preferred over static keys.

AWS IAM Roles and Policies
AWS IAM Roles and Policies

Human Access

MethodCredentialsBest PracticeExample
IAM UserUsername/Password, Access KeysUse sparingly, rotate keysDeveloper logging in via AWS CLI
Federated RoleTemporary STS TokensPreferred for enterprise SSOEngineer logs in via Okta → assumes IAM role

AWS Services Accessing Other Services

ServiceMechanismCredential SourceNotes
EC2Instance ProfileIMDS → STS Temporary CredentialsApplications fetch credentials via metadata service
LambdaExecution RoleAWS auto-injects credentialsRole defines what function can access
ECSTask RoleSTS Temporary CredentialsEach task can have its own role
EKSIAM Role for Service Account (IRSA)STS Temporary CredentialsPods assume roles via service accounts
Other AWS ServicesService-linked RoleManaged by AWSAuto-created for services like Auto Scaling, CloudWatch

On-Prem Applications Accessing AWS

MethodCredential TypeBest PracticeExample
IAM User KeysLong-term Access KeysDiscouragedLegacy Windows app with static keys
Federation + STS AssumeRoleTemporary STS TokensPreferredAD-authenticated app assumes AWS role
IAM Identity Center (SSO)Short-lived CLI/SDK credentialsRecommendedOn-prem CLI session via SSO

IAM Policies

Policies are JSON documents defining permissions. They specify actions, resources, and conditions. Explicit Deny always overrides Allow.

Policy TypeScopeUse Case
Identity-basedUsers, Groups, RolesGrant permissions to identities
Resource-basedAttached to resourcesS3 bucket policy allowing cross-account access
Permission BoundariesIAM identitiesLimit maximum permissions
Service Control Policies (SCPs)AWS OrganizationsRestrict actions across accounts
Session PoliciesTemporary sessionsNarrow permissions during AssumeRole

EC2 Instance Metadata Service (IMDS) Flow

Applications inside EC2 fetch temporary credentials from IMDS, which provides STS-issued keys tied to the instance’s IAM role. IMDSv2 requires session tokens for added security.

  • App requests token from IMDSv2 (PUT request).
  • App fetches credentials with token (GET request).
  • IMDS returns Access Key ID, Secret Key, Session Token, Expiration.
  • App uses credentials to call AWS APIs.
  • IAM evaluates role policies; CloudTrail logs the activity.

Reference Table

ActorMechanism to Assume Role
Human UserIAM User or Federated Role
EC2 InstanceInstance Profile
ECS TaskTask Role
EKS PodIAM Role for Service Account
Lambda FunctionExecution Role
AWS ServicesService-linked Role
On-Prem AppFederation + STS or IAM User Keys
Cross-Account AccessResource-based Policy + AssumeRole