When an EC2 instance, Lambda, or EKS pod needs AWS permissions, it should assume a role, not use access keys.
- EC2 instance profile — attaches a role to an EC2 instance
- Lambda execution role — attaches a role to a Lambda function
- IRSA (IAM Roles for Service Accounts) — attaches AWS roles to Kubernetes pods on EKS
- Cross-account access — Role A in Account 1 trusts Account 2's principals to assume it
Trust policy vs permissions policy:
- The trust policy (also called assume role policy) says who can assume this role
- The permissions policy says what the role can do once assumed