IAM Roles vs IAM Users in AWS: A Hands-on EC2 to S3 Lab

AWS IAM Roles vs IAM Users: A Hands-on EC2 to S3 Lab

When working with AWS, choosing the right identity is essential for security. Many beginners store AWS access keys in application code, which can expose their accounts to security risks.

IAM User vs IAM Role

• IAM User: An identity that can have long-term access keys or console credentials.
• IAM Role: An identity that provides temporary credentials to authorized users, AWS services, or applications.

Best practice: Prefer IAM Roles for AWS workloads instead of storing permanent access keys.

Hands-on Lab: EC2 to S3 Access

Objective: Allow an EC2 instance to list and read S3 objects without hardcoding AWS credentials.

1. Create an IAM Role with EC2 as the trusted service.
2. Attach an appropriate S3 read-only permissions policy.
3. Create an instance profile and associate the role with EC2.
4. Connect to your EC2 instance.
5. Verify the identity and S3 access:

aws sts get-caller-identity
aws s3 ls s3://YOUR-TEST-BUCKET/

Replace YOUR-TEST-BUCKET with your actual bucket name.

Key Security Best Practices

• Use IAM Roles for EC2, Lambda, and supported CI/CD workflows.
• Follow the principle of least privilege.
• Use GitHub Actions OIDC instead of long-term access keys where possible.
• Enable MFA for human access.
• Monitor AWS activity using CloudTrail.

Conclusion

IAM Roles help applications access AWS securely using temporary credentials. Understanding the difference between trust policies and permission policies is an important step toward building secure cloud infrastructure.

What's next? I'll explore building AWS infrastructure using Terraform.

Connect With Me

• LinkedIn: https://www.linkedin.com/in/vishalpatil-devops-aws/
• GitHub: https://github.com/VishalPatil-DevOps-AWS

AWS #IAM #DevOps #CloudSecurity #AWSCloud