Cloud Security Architecture
IAM Roles vs. Users
Mastering the balance between long-term persistence and temporary security tokens.
The Identity Components
IAM User
Long-term Access
- Permanent identity for specific people or apps.
- Static Credentials (Access Key ID & Secret Key).
- Requires manual rotation and lifecycle management.
IAM Role
Temporary Access
- Assumable by users, services, or external identities.
- Dynamic Tokens (STS) that expire automatically.
- No keys to leak long-term; higher security posture.
How Credentials Flow
Comparing the direct path vs. the secure delegation path
Direct Access
The user holds the key permanently. If stolen, the resource is exposed until the key is deleted.
VS
Delegated Access
The entity requests a token from STS. Access expires automatically, minimizing the “blast radius.”