How does an EC2 instance assume a role, and why is that better than embedding keys?
AWS · Basic level
Answer
EC2 assumes a role through an instance profile and retrieves temporary credentials from the Instance Metadata Service. This is better than embedding keys because credentials rotate automatically, expire, are auditable, and can be tightly scoped.
Technical explanation
Enforce IMDSv2 on EC2 so metadata credentials are harder to steal through SSRF-style attacks.
IAM evaluation is layered: identity policies, resource policies, trust policies, boundaries, SCPs, session policies, and explicit denies all contribute to the final decision.
Prefer temporary credentials through STS, roles, IAM Identity Center, instance profiles, IRSA, or OIDC federation instead of long-lived access keys.
Use conditions, resource ARNs, tags, MFA requirements, external IDs, source account/source ARN constraints, and Access Analyzer to reduce blast radius.
Hands-on example
1. Create a least-privilege IAM role for a small workload, including trust policy, permission policy, tags, and CloudTrail visibility.
2. Test the role with aws sts get-caller-identity and one allowed action, then deliberately test one denied action.
3. Run IAM Access Analyzer or policy simulation and refine broad actions/resources before production.
4. Record the access pattern in IaC and require review for future policy changes.
Check how well your resume matches the role with our free resume checker— match score, ATS check, and the skills you're missing.
More AWS interview questions
- What is the AWS shared responsibility model, and where is the line between AWS and the customer?
- Explain the difference between a Region, an Availability Zone, and an Edge Location.
- What is a VPC, and what are its core components (subnets, route tables, IGW, NAT)?
- Difference between a public and a private subnet, and how does each reach the internet?
- What is the difference between a Security Group and a Network ACL?
- Are Security Groups stateful or stateless? What about NACLs?
- What is an Internet Gateway versus a NAT Gateway, and when do you need each?
- How does a NAT Gateway differ from a NAT instance?