Service Comparison

IAM User vs IAM Role

Users are long-lived identities. Roles are assumed for temporary credentials.

What They Have in Common

Each option can solve part of the scenario. The exam expects you to choose the one that satisfies the stated constraints with the right operational burden, security boundary, availability model, and cost behavior.

Key Differences

Option	Primary model	Best use	Security	Availability	Operations and cost
IAM user	Long-lived principal	Rare workforce or legacy programmatic access when federation is unavailable	MFA, access key rotation, least privilege	Credential lifecycle burden
IAM role	Assumable identity	EC2/Lambda/ECS workload access, cross-account, federation	Trust policy, permissions policy, STS	Preferred for temporary access

Typical Exam Clues

Practice After Studying

Return to the certification guide that includes this comparison and launch domain training from there.

Sources and Review Metadata

AWS service documentation https://docs.aws.amazon.com/ Reviewed 2026-08-07

AWS Well-Architected Framework https://docs.aws.amazon.com/wellarchitected/latest/framework/welcome.html Reviewed 2026-08-07

This independent training application is not affiliated with or endorsed by Amazon Web Services. AWS, Amazon Web Services, and AWS certification names are trademarks of Amazon.com, Inc. or its affiliates.