Use roles almost always. A role provides short lived credentials that a service, workload or federated human assumes on demand, so there is no static key to leak or rotate. IAM users mean long lived access keys, which should be limited to systems that genuinely cannot federate. For people, use single sign on with role assumption; for CI systems, use OIDC federation to exchange a job token for a role.
Why interviewers ask this
This is a quick credential hygiene check. The interviewer wants to hear that static keys are the exception and that you know the modern alternatives for both humans and machines. Candidates who reach for an IAM user and an access key by default usually have long lived keys scattered across their environments, which is the single most common source of cloud compromise.
How to structure your answer
- State the default clearly: roles, because credentials are temporary.
- Explain how a workload and a human each obtain a role.
- Name the narrow cases where a user is still justified.
- Say how you find and eliminate existing long lived keys.
Example answer
My default is roles for everything, because the credentials are temporary and issued on demand, so there is nothing sitting in a config file waiting to be committed to a repository. A workload in the cloud gets a role attached to the instance, task or function and picks up credentials from the metadata service. A person gets there through single sign on, assuming a role for a session with an expiry. A build pipeline outside the cloud uses identity federation, so the job presents a signed token from its provider and exchanges it for a scoped role that lasts minutes. That last one removed the last set of static keys we had. IAM users I keep for the genuinely stubborn cases, usually an old third party integration that only knows how to take a key and a secret, and those get scoped to one action on one resource, rotated on a schedule, and monitored. When I inherit an account, one of the first things I do is pull the credential report and hunt for keys that are years old and still active.
Walking into this interview soon? GhostPilot listens to your live call, spots the question the moment it is asked, and puts a structured answer on your screen in real time. Try it on your next mock, or grab a $29 Session Pass, no subscription, for the real thing.
See how it worksFollow-up questions to expect
- How does a workload outside the cloud assume a role safely?
- What would you do about a key that has been unused for a year?
- How do you handle break glass access if single sign on is down?
Related cloud engineer questions
Your interviewer will ask their own version of this. Paste your actual job description into the free Question Predictor and get the 20 questions that role is most likely to ask, with what each one is really probing.
Predict my questions