IAM Roles for Services

Opening Scenario

Your Lambda function needs to read from an S3 bucket and write to a DynamoDB table. Your EC2 instance running a batch job needs to call the Secrets Manager API and put metrics into CloudWatch. A junior engineer on the team suggests: "Let's just create an IAM user, generate an access key, and put it in an environment variable." You know this is wrong — but do you know exactly why, and what to do instead?

---

Question Progression

1. Why are long-lived credentials a problem?

Question: An IAM user access key is a static credential: an access key ID and secret. What could go wrong with storing it in an environment variable on an EC2 instance?

Reasoning: Static credentials don't expire. Once created, they work until you explicitly revoke them. They can be:

• Accidentally committed to a git repository
• Exposed in deployment scripts, CI/CD logs, or AMI images