When to Create an IAM User Instead of an IAM Role

CLF-C02 By islever Editorial Last updated

Identify AWS access management capabilities.

Short answer

B Create an IAM user when the company generates AWS access credentials for specific individuals who need long-term sign-in keys.

Question

In which situations should a company create an IAM user instead of an IAM role?
  1. When an application that runs on Amazon EC2 instances requires access to other AWS services
  2. When the company creates AWS access credentials for individuals Correct Answer
  3. When the company creates an application that runs on a mobile phone that makes requests to AWS
  4. When the company needs to add users to IAM groups
  5. When users are authenticated in the corporate network and want to be able to use AWS without having to sign in a second time

Key Takeaways

The question tests whether you know that long-term credentials belong to people (IAM users), and the trap is selecting the IAM-group option because groups only contain users.

This CLF-C02 question tests which scenario calls for an IAM user rather than an IAM role in AWS identity design. It establishes that issuing long-term AWS access credentials to specific named individuals is the case that requires an IAM user, while workloads, apps, and federated sign-in should use roles.

Common mistake: Most learners pick D, reasoning that IAM groups can contain only users — but membership in a group is an organizational structure, not a justification for creating a user instead of a role.

Expert Analysis

Why the Answer Is Correct

Option B is correct because IAM users are the only identity type that holds long-term AWS credentials — an access key ID/secret access key pair or a console password — which is exactly what a company creates when it provisions credentials for individual people. AWS guidance recommends reserving IAM users for humans who must sign in to the Management Console or call the CLI/SDK on an ongoing basis. Options A, C, and E all describe situations where AWS explicitly directs you to an IAM role with temporary, automatically rotated credentials instead.

Why the Other Options Are Wrong

Option A (an application on Amazon EC2 calling other AWS services) is a textbook instance-profile role case, since the role supplies temporary credentials without storing keys on the instance. Option C (an app running on a mobile phone) similarly belongs to roles or credential-pooling services, not a fixed IAM user. Option E (corporate-network users authenticating without a second sign-in) describes federation through SAML/OIDC, which by design issues role-based temporary access. Option D (adding users to IAM groups) is a management convenience: groups exist only to attach policies to collections of users, so group membership is not a reason to create a user instead of a role.

Community Comment Notes

Ty13 pushed back on the crowd with B, stating "D is a structural choice, not a reason to create an IAM user in the first place," and ShaiTay and d00b229 independently landed on B as well. The vote majority still went to D with 60 of 100 votes, echoed by 123asdzxcxza's brief "Also D." Those votes reflect a memorized fact about group contents rather than AWS identity doctrine, so the analysis here departs from the suggested key and the majority.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

On CLF-C02, sort each option by identity type: a named human needing long-term keys = IAM user; an EC2 app, mobile app, or federated sign-in = IAM role. Eliminate the three role-friendly scenarios first, then decide between the credential option and the grouping option.

Frequently Asked Questions

Why isn't adding users to IAM groups a valid reason to create a user instead of a role?

Groups are a management structure: only users can belong to them and groups just attach policies in bulk. That fact does not decide whether a user or a role is the correct identity type.

When should an EC2-hosted application use a role rather than an IAM user?

Attach an instance-profile role so AWS delivers temporary credentials automatically to the instance, eliminating any long-term access keys stored on the host.

More CLF-C02 FAQ →

Community Votes

D
60%
B
40%

60% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. Ty13 👍 1 Answered B
    IAM Users are for people who access AWS through the Management Console or CLI/SDKs. D is a structural choice, not a reason to create an IAM user in the first place.
  2. ShaiTay 👍 1 Answered B
    B. When the company creates AWS access credentials for individuals
  3. 123asdzxcxza 👍 3 Answered D
    Also D

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Which migration strategies move a cloud-incompatible CMS with least effort?

S-grade

Launching Third-Party IDS in AWS

S-grade

Which AWS Support Plan Offers API Access Most Cost-Effectively?

S-grade

S3 Express One Zone for Single-Digit Millisecond Latency

S-grade

Practice All CLF-C02 Questions

Access 120 questions with complete answers and detailed explanations.

View Full CLF-C02 Practice Test →

← Back to CLF-C02 Study Guide