Difference between IAM role and IAM user in AWS : <p>What is the difference between an IAM role and an IAM user? The <a href="https://aws.amazon.com/iam/faqs/" rel="noreferrer">IAM FAQ</a> has an entry explaining it, but it was vague and not very clear:</p>

<blockquote>
  <p>An IAM user has permanent long-term credentials and is used to directly interact with AWS services. An IAM role does not have any credentials and cannot make direct requests to AWS services. IAM roles are meant to be assumed by authorized entities, such as IAM users, applications, or an AWS service such as EC2.</p>
</blockquote>

<p>I think an IAM role is used for federated logins (using an IdP with SAML tokens for example), and they don't have permanent access keys that you can download like regular IAM users have (the "an IAM role doesn't have any credentials" part).</p>

<p>What do they mean when they say an IAM role can't make direct requests to AWS services? I can login to AWS Console (the web console) and create stacks etc, so it can't be that.</p>
