Security best practice

Question

Hi

I am creating a simple external backend that should access an S3 bucket. I need a Test and a Prod environment. According to my research so far, the safest best practice would be to have an AWS account per environment, create a user for the backend, and create a role allowing to access the particular bucket that can only be assumed by the user. Is this correct?

Now, I had a hard time understanding already what the general difference in security is between IAM users and roles. If I grant the user direct access to the bucket, an attacker who finds the user credentials can access the bucket. If I go via roles instead, the attacker can still do the exact same thing if they find the credentials can't they? My current guess is, that roles allow more fine-grained control over e.g. when permissions are granted. For example, I could allow a user to do certain work only at specific times. But considering the scenario, that an attacker steals the user credentials, the role model doesn't really have an advantage over the pure-user model. So if I don't have any further restrictions I want to impose onto the access, going with just a user should be fine right?

I am also totally overwhelmed with the organizations and the possibility to define users there. Apparently, this makes sense for human users. But does it also for my backend user? Should I just define it in the management account? That would mean that an attacker with credentials for this user would directly get access to data in all environments.

Thank you, any help appreciated! :)

re:Post Agent · Answer

You're on the right track with some of your security considerations, but let me clarify a few important points about AWS best practices for your scenario.

Having separate AWS accounts for Test and Prod environments is indeed a best practice. This provides strong isolation between environments and limits the blast radius if credentials are compromised.

Regarding IAM users versus roles, there's a fundamental security difference. IAM users have long-term credentials (passwords and access keys) that don't automatically expire. IAM roles, on the other hand, provide temporary credentials that are automatically rotated. For applications running on AWS services like EC2, the recommended approach is to use IAM roles rather than embedding user credentials.

For your backend application accessing S3, the most secure approach would be:
1. Create an IAM role in each account (Test and Prod) with the specific permissions needed to access only the relevant S3 bucket
2. Attach this role to the AWS service running your backend (like EC2, Lambda, etc.)
3. Let the application use the role's temporary credentials automatically

This approach avoids storing any long-term credentials in your application or instances. If you were to use an IAM user with access keys embedded in your application, those credentials would be at risk of exposure and wouldn't automatically rotate.

If your backend is running outside of AWS, you might need to use IAM users with access keys, but this is less secure than using roles. In this case, implement strict key rotation policies and use the principle of least privilege when assigning permissions.

For organizations, the management account should be highly restricted and not used for operational workloads. Your backend users or roles should be defined in the respective member accounts (Test and Prod), not in the management account.

Remember to implement the principle of least privilege by granting only the specific permissions needed (like specific S3 actions on specific buckets) rather than broad permissions.  
**Sources**  
[Security best practices for Amazon S3 - Amazon Simple Storage Service](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html)  
[Community | Securely Access Resources with IAM Service Roles](https://community.aws/tutorials/practical-cloud-guide/securely-access-resources-with-iam-service-roles)  
[SEC03-BP02 Grant least privilege access - AWS Well-Architected Framework](https://docs.aws.amazon.com/wellarchitected/2025-02-25/framework/sec_permissions_least_privileges.html)  
[What’s the difference between an IAM User and an IAM Role in AWS? | AWS re:Post](https://repost.aws/questions/QUNdYj3YOpTA67xtFh4DkWCQ/whats-the-difference-between-an-iam-user-and-an-iam-role-in-aws)

Gary Mclean · Answer

If your backend is running on AWS you should use roles. If it’s external you may need to use IAM access keys or OIDC authentication

Security best practice

Add your answer

Relevant content