In which situation is creating an IAM user more appropriate than creating an IAM role?

Creating an IAM user is appropriate when the organization needs to add individual people to IAM groups because IAM users represent specific individuals or services that interact directly with AWS. IAM users can be assigned to groups, inheriting permissions defined for that group, simplifying access management for multiple users with similar job functions. Let's look at why the other options are less suitable: An application running on Amazon EC2 needing access to other AWS services should use an IAM role, which can be assumed by the EC2 instance, providing temporary credentials without hardcoding them. Issuing AWS access credentials to individual people is exactly what IAM users are for, but the question asks for a situation where creating an IAM user is more appropriate than an IAM role. While IAM users get credentials, the core purpose is often to manage individuals, especially within groups. A mobile application making requests to AWS typically uses temporary credentials obtained through services like Amazon Cognito, which can assume an IAM role. When users are authenticated by a corporate directory, they should use an IAM role via identity federation (e.g., SAML), allowing them to sign in once and assume a role in AWS.