When should you use a service principal, and what are its advantages and disadvantages?

A service principal is an AWS identity that represents an AWS service (e.g., ec2.amazonaws.com, s3.amazonaws.com). It is used when that service needs to assume a role to perform actions on your behalf. Use a service principal when you want to grant an AWS service permissions to access resources without embedding long‑term credentials in your code.

Advantages:

• Fine‑grained access: you can grant only the permissions the service needs.

• No long‑term credentials: the service assumes the role at runtime, reducing credential leakage risk.

• Automatic credential rotation: AWS manages temporary security tokens.

Disadvantages:

• Complexity: setting up trust policies and role permissions can be error‑prone.

• Limited to AWS services: only AWS services can use service principals.

• Auditing: tracking which service accessed what can be harder than with user credentials.

Example: Grant an EC2 instance permission to read from an S3 bucket by creating a role with a trust policy that allows ec2.amazonaws.com to assume it, then attaching an S3 read policy to that role.