IAM role

What it means

An IAM role is a set of permissions in a cloud account that has no password or long-term keys of its own. A person, a server or a service assumes the role when needed and receives temporary credentials. In AWS those credentials come from the Security Token Service.

Two policies define a role. The permissions policy says what the role may do. The trust policy says who may assume it. Both matter. A tight permissions policy does little good if any account on the internet is allowed to take the role.

Why it matters

Roles are how modern cloud systems grant access without scattering long-lived keys through code. Used well, they limit damage, because the credentials expire and each workload gets only what it needs. Used badly, a single role with broad permissions turns any foothold into access to everything.

An over-broad role is a common route for privilege escalation and lateral movement inside a cloud account. It is also a standard audit question: who can reach production data, and why. Without a clean answer, a sales cycle with a larger customer can stall.

How it shows up

You meet roles on servers, containers, functions, pipelines and for people signing in through a company identity provider. The repeated mistakes are wildcard permissions, one shared role for many services, trust policies that allow far too much, and roles that can create or change other roles.

Follow least privilege: one role per workload, only the actions and resources it needs, short session lengths. Review unused permissions, which cloud tools can report. Test by asking what an attacker could do if one workload were compromised, and following the role it holds.