IAM for applications: execution roles, instance profiles, ECS task roles, least-privilege policies, policy evaluation (explicit deny wins)

Applications need permissions just as people do, and AWS Identity and Access Management (IAM) provides them through roles. A role is an identity with permission policies but no long-term password or access keys; whoever is allowed to assume it gets temporary credentials from the AWS Security Token Service (STS). Giving your code a role, rather than embedding an IAM user's access keys, is the pattern the exam expects every time.