Should I use IAM users or roles for EC2?
Always use IAM roles for EC2. Roles provide temporary credentials that rotate automatically no access keys in .env. The AWS SDK on EC2 automatically uses the attached role's credentials. IAM users with access keys are for CLI access from your laptop or applications outside AWS.
Verify This Answer
Cross-check this information using these trusted sources:
More FAQs in AWS IAM and Least Privilege for Node.js Secure Your App's AWS Access
IAM (Identity and Access Management) controls who can access your AWS resources. It manages users (long-lived credentials), roles (temporary credentials for EC2/Lambda), groups (collections of users), and policies (JSON documents defining permissions).
Least privilege means granting only the minimum permissions needed. Instead of AmazonSESFullAccess (which allows everything), create a custom policy that only allows ses:SendEmail from your specific domain. This limits damage if credentials are compromised.
Go to IAM → Policies → Create policy. Use the JSON editor to specify Effect (Allow/Deny), Action (e.g., ses:SendEmail), and Resource (e.g., ARN of your verified domain). Attach the policy to your EC2 role or IAM user. Test with the IAM Policy Simulator.
Still have questions?
Browse all our FAQs or reach out to our support team