Why an IAM role is safer than sharing access keys
A role gives a trusted system temporary credentials for a defined purpose. The customer keeps control of the trust policy and can remove that access.
Start with the trust decision
An IAM role answers two different questions: who may assume me? in its trust policy, and what may I do? in its permissions policies. Both must be correct.
Misconfig service identityAssumeRole + external ID →Customer read roleTemporary credentials →AWS read APIs
Practice
A vendor asks for an access key so it can inspect CloudWatch and ECS. Which change gives the customer the clearest control?
Lesson completion is disabled in the public demo; points are only awarded from verified server-side events.