AWS offers many different methods for users to authenticate their accounts through the IAM service, the most common of which include user accounts and roles. IAM users provide means of setting up credentials for something that needs long-term access to the environment. Users can access the AWS APIs by authenticating with the web UI using a username and password, or by using API keys (an access key ID and secret access key) to programmatically make requests.
Roles, on the other hand, provide means of delegating temporary credentials to users/services/applications as they need them. An IAM user who has the sts:AssumeRole permission can assume a role to get a set of API keys (an access key ID, secret access ...
