Explain IAM users, groups, roles and policies. When would you use a role instead of a user?

What the interviewer wants to hear

• Users are long-term identities for people or legacy apps
• Groups collect users to share permissions
• Roles are assumed and give temporary credentials
• Policies are JSON documents defining allowed or denied actions on resources
• Use roles for services, cross-account access and federated human access

Model answer

IAM controls who can do what in a cloud account. A user is a long-term identity with a password or access keys. A group is a collection of users so you can attach permissions once, for example a Developers group. A policy is a JSON document listing allowed or denied actions on specific resources, with optional conditions. A role is an identity with permissions but no permanent credentials; a trusted principal assumes it and receives temporary credentials. I use roles almost everywhere: for EC2 instances and Lambda functions, for CI pipelines using OIDC federation, for cross-account access, and for engineers who log in through SSO with IAM Identity Center. Temporary credentials expire automatically, so there are no long-lived keys to leak. In all cases I follow least privilege and review unused permissions regularly.

More easy Cloud Engineer questions

• Explain the difference between IaaS, PaaS and SaaS with an example of each.
• What is a VPC and what are its main building blocks?
• How would you make a simple web application highly available in the cloud?
• What pricing models do cloud providers offer for compute, and when would you use each?
• What is the difference between containers and virtual machines, and when would you choose each?
• What is Infrastructure as Code and why do teams use it instead of the cloud console?
• Explain metrics, logs and traces. How does each help you run a cloud application?
• How does a CDN work, and what should you consider when caching content with one?
• Compare block, object and file storage in the cloud. Give a use case for each.