How does IAM role assumption work?
Interviewer Expectations for this Question
01
Core Competency
Assesses fundamental understanding of AWS conventions, runtime behavior, and memory/performance considerations.
02
Evaluation Criteria
Hiring managers look for precision, avoidance of ambiguous jargon, and ability to explain trade-offs under real production conditions.
Comprehensive Model Answer
Verified Solution
A role is an identity with permission policies but no permanent credentials. A trusted principal calls AWS STS AssumeRole and receives temporary credentials.
Flow:
- The role has a trust policy naming who may assume it, such as an account, user, service, or federated identity.
- The caller invokes sts:AssumeRole and STS returns an access key, secret key, and session token that expire.
- Requests signed with those temporary credentials are evaluated against the role's permission policy.
aws sts assume-role --role-arn arn:aws:iam::111122223333:role/Deploy \
--role-session-name deploy-1
Common uses include EC2 instance profiles, ECS and Lambda execution roles, cross-account access, and web identity federation. Prefer roles over long-lived access keys because credentials rotate automatically and can be scoped further with a session policy.
Candidate Response Strategy & Interview Tips
- Start with a concise one-sentence summary: Deliver a direct, confident answer first before expanding into nuances.
- Demonstrate real-world trade-offs: Discuss where this approach excels and when you would avoid it in production systems.
- Discuss complexity & edge cases: Proactively explain time/space complexity or boundary conditions (null values, scale limits).
- Prepare for interviewer follow-ups: Technical hiring panels frequently probe deeper into concurrency, backward compatibility, or alternative libraries.