When to Create an IAM User Instead of an IAM Role
In which situations should a company create an IAM user instead of an IAM role?
Community Votes
60% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests whether you know that long-term credentials belong to people (IAM users), and the trap is selecting the IAM-group option because groups only contain users.
This CLF-C02 question tests which scenario calls for an IAM user rather than an IAM role in AWS identity design. It establishes that issuing long-term AWS access credentials to specific named individuals is the case that requires an IAM user, while workloads, apps, and federated sign-in should use roles.
Most learners pick D, reasoning that IAM groups can contain only users — but membership in a group is an organizational structure, not a justification for creating a user instead of a role.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option B is correct because IAM users are the only identity type that holds long-term AWS credentials — an access key ID/secret access key pair or a console password — which is exactly what a company creates when it provisions credentials for individual people. AWS guidance recommends reserving IAM users for humans who must sign in to the Management Console or call the CLI/SDK on an ongoing basis. Options A, C, and E all describe situations where AWS explicitly directs you to an IAM role with temporary, automatically rotated credentials instead.Why the Other Options Are Wrong
Option A (an application on Amazon EC2 calling other AWS services) is a textbook instance-profile role case, since the role supplies temporary credentials without storing keys on the instance. Option C (an app running on a mobile phone) similarly belongs to roles or credential-pooling services, not a fixed IAM user. Option E (corporate-network users authenticating without a second sign-in) describes federation through SAML/OIDC, which by design issues role-based temporary access. Option D (adding users to IAM groups) is a management convenience: groups exist only to attach policies to collections of users, so group membership is not a reason to create a user instead of a role.Community Comment Notes
Ty13 pushed back on the crowd with B, stating "D is a structural choice, not a reason to create an IAM user in the first place," and ShaiTay and d00b229 independently landed on B as well. The vote majority still went to D with 60 of 100 votes, echoed by 123asdzxcxza's brief "Also D." Those votes reflect a memorized fact about group contents rather than AWS identity doctrine, so the analysis here departs from the suggested key and the majority.Official Reference
Exam Strategy
On CLF-C02, sort each option by identity type: a named human needing long-term keys = IAM user; an EC2 app, mobile app, or federated sign-in = IAM role. Eliminate the three role-friendly scenarios first, then decide between the credential option and the grouping option.
Frequently Asked Questions
Why isn't adding users to IAM groups a valid reason to create a user instead of a role?
Groups are a management structure: only users can belong to them and groups just attach policies in bulk. That fact does not decide whether a user or a role is the correct identity type.
When should an EC2-hosted application use a role rather than an IAM user?
Attach an instance-profile role so AWS delivers temporary credentials automatically to the instance, eliminating any long-term access keys stored on the host.
Related Analysis
Practice All CLF-C02 Questions
Access 120 questions with complete answers and detailed explanations.
View Full CLF-C02 Practice Test →