Users, Roles and Policies in Cloud IAM

Try it out loud first. Then check yourself:

1. A policy is a document of allowed or denied actions on resources; it does nothing until attached to an identity or resource.
2. An IAM user is a long-lived identity, often with access keys that never expire unless someone rotates them.
3. A role is assumed for a while and hands out temporary credentials, so nothing permanent can leak.
4. Prefer SSO for people and roles for workloads; keep IAM users with access keys only as a documented exception.

If the interviewer pushes back

• What is the difference between an identity-based policy and a resource-based policy?

Go deeper

• docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html