These questions are independently created for study purposes. They are not official AWS exam questions, actual exam questions, leaked questions, or exam dumps.
CLF-010
Which of the following best describes an IAM role?
Choices
Explanation and answer
Read the explanation and correct answer (spoiler — try answering first)
Correct answer: A. A mechanism for granting permissions to AWS services or users using temporary credentials.
Explanation
An IAM role is a mechanism that grants permissions to AWS services or users using temporary credentials.
Per-choice explanations
A. A mechanism for granting permissions to AWS services or users using temporary credentials.
Correct. The key point of an IAM role is the use of temporary credentials.
B. A service that compresses images in an S3 bucket.
Incorrect. It is not an image compression service.
C. The domain registration feature of Route 53.
Incorrect. Domain registration is a feature of Route 53.
D. A graph that displays the CPU utilization of an EC2 instance.
Incorrect. Displaying metrics is the domain of CloudWatch.
Practical Use
An IAM role is a mechanism for granting permissions to AWS resources or users by issuing temporary credentials. Whereas an IAM user holds long-term credentials (password and access keys) tied to a person, an IAM role is not tied to an entity and is assumed at the time it is needed (AssumeRole) so that temporary credentials (an access key ID, a secret access key, and a session token issued by STS) are handed out. The issued credentials have an expiration set on them, and the impact range in case of leakage is limited along the time axis. This is the biggest advantage compared with long-lived access keys. There are three representative usage patterns in practice. The first is the EC2 instance profile, which is a configuration where an application running on EC2 obtains permissions via an IAM role rather than embedding access keys in code or environment variables when it accesses S3 or DynamoDB. The second is the Lambda execution role, which is used as the authentication used when a Lambda function accesses other AWS services. The third is cross-account access, where you allow AssumeRole to an IAM user or role in a different AWS account, achieving cross-account integration without sharing long-term credentials. IAM Identity Center (formerly SSO) and Cognito also internally use the temporary credential issuance mechanism of IAM roles. On CLF-C02, this content is asked in the form of which of the following best describes an IAM role, or what is the method to access S3 from EC2 without using access keys. Typical distractors apply services in different domains from IAM, such as an image compression service, displaying metrics, or a domain registration feature. From SAA-C03 onward, the proper use of IAM users, groups, roles, and policies, the difference between trust policies and permission policies, and the authorization flow of AssumeRole are asked in more depth.