DJames617 Service Comparison
IAM User vs IAM Role
Users are long-lived identities. Roles are assumed for temporary credentials.
What They Have in Common
Each option can solve part of the scenario. The exam expects you to choose the one that satisfies the stated constraints with the right operational burden, security boundary, availability model, and cost behavior.
Key Differences
| Option | Primary model | Best use | Security | Availability | Operations and cost |
|---|---|---|---|---|---|
| IAM user | Long-lived principal | Rare workforce or legacy programmatic access when federation is unavailable | MFA, access key rotation, least privilege | Single identity; availability depends on IAM control plane | Higher credential-management burden; avoid for workloads |
| IAM role | Assumable identity | EC2/Lambda/ECS workload access, cross-account, federation | Trust policy, permissions policy, STS | Temporary credentials can be reissued | Preferred for temporary access; no long-lived key rotation |
Typical Exam Clues
Practice After Studying
Return to the certification guide that includes this comparison and launch domain training from there.