// Module included in the following assemblies:
//
// * cloud_experts_tutorials/cloud-experts-getting-started/cloud-experts-rosa-sts-explained.adoc

:_mod-docs-content-type: CONCEPT
[id="cloud-experts-rosa-different-credential-methods-rosa_{context}"]
= Different credential methods to deploy {product-title}

[role="_abstract"]
As part of {product-title}, Red{nbsp}Hat manages infrastructure resources in your AWS account and must be granted the necessary permissions. There are currently two supported methods for granting those permissions:

* Using static IAM user credentials with an `AdministratorAccess` policy
+
This is referred to as "{product-title} with IAM Users" in this tutorial. It is not the preferred credential method.
+
* Using AWS STS with short-lived, dynamic tokens
+
This is referred to as “{product-title} with STS” in this tutorial. It is the preferred credential method.

[id="different-credential-methods-rosa-iam-users_{context}"]
== Rosa with IAM Users

When {product-title} was first released, the only credential method was {product-title} with IAM Users. This method grants IAM users with an `AdministratorAccess` policy full access to create the necessary resources in the AWS account that uses {product-title}. The cluster can then create and expand its credentials as needed.

[id="different-credential-methods-rosa-sts_{context}"]
== {product-title} with STS

{product-title} with STS grants users limited, short-term access to resources in your AWS account. The STS method uses predefined roles and policies to grant temporary, least-privilege permissions to IAM users or authenticated federated users. The credentials typically expire an hour after being requested. Once expired, they are no longer recognized by AWS and no longer have account access from API requests made with them. For more information, see the link:https://docs.aws.amazon.com/STS/latest/APIReference/welcome.html[AWS documentation]. While both {product-title} with IAM Users and {product-title} with STS are currently enabled, {product-title} with STS is the preferred and recommended option.