PRODUCTION SCENARIO
An application on Amazon EC2 calls Amazon Bedrock using temporary credentials from an IAM role. A developer proposes replacing the role with a long-lived access key so the team does not have to handle rotation.
Which credential design should the team use?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: Keep the IAM role so the SDK refreshes its temporary credentials.
AWS delivers the temporary credentials of an IAM role to an EC2 instance and the SDK discovers and refreshes them, so no long-lived credential is distributed and there is no rotation to handle. Caching the credentials in the application defeats that refresh and breaks when they expire. An access key in Secrets Manager is protected at rest but stays valid until revoked. IAM Roles Anywhere delivers temporary credentials to workloads outside AWS, which this one is not.