AWS角色：权限如何从EC2实例过渡到实例中运行的应用程序？

Question

TLDR; How to move a java app using AWS services from dev to prod (on AWS Cloud.)

Having understood that AWS IAM Roles are for AWS Services like EC2 etc so that's applications running under these service will assume the permissions assigned to the role.

IAM roles are meant to be assumed by authorized entities, such as IAM users, applications, or an AWS service such as EC2.

I am not clear with how permissions transition from an EC2 instance with some role,say S3RWRole , to (a java ) application running in the instance?

During application development, this is what we do - Say, I have a simple S3 application that's working with files in some S3 bucket. I ensure that during development, the java code/app has necessary permissions by configuring the AWS client.

AWSCredentials credentials = new BasicAWSCredentials(
  "<AWS accesskey>", 
  "<AWS secretkey>"
);

Then configure/obtain the S3 client,

AmazonS3 s3client = AmazonS3ClientBuilder
  .standard()
  .withCredentials(new AWSStaticCredentialsProvider(credentials))
  .withRegion(Regions.US_EAST_2)
  .build();

Then perform some S3 operations,

s3client.putObject(
  bucketName, 
  "Docs/file.txt", 
  new File("/home/me/file.txt")
);

Now, how does it look in production.
The AwSCredential I think are still required. Are not they??? Ok, let me assume that they are required (as to avoid a runtime error). So, I have created an IAM user ProdJavaUserApp and now the java app is running with ProdJavaUserApp credentials/permissions.
But now say, the EC2 instance this application is running on has S3RWRole , will the permissions of S3RWRole takeover/replace the ProdJavaUserApp .

What further do I need to understand, could someone shed some light.

Answer 1

When AWS role is attached to the instance those default "credentials" are used for all operations unless you specifically mention some other aws access and secret key. If you don't mention any access/secret key the default role credentials are applied. It's like when you install aws cli on your machine and configure it with aws credentials.

So you can simply skip the .withCredentials parameter in your s3 call.