AWS access from within EC2 instances is facilitated either by embedding AWS keys in API requests or by assigning the instance to an IAM role with an associated permissions policy that grants the necessary access. AWS Access enables interaction with the APIs of AWS services, allowing the management and utilization of AWS resources.

IAM roles help mitigate the risks associated with the sharing and rotation of credentials that can be used outside the AWS environment. If credentials are compromised, they can potentially be leveraged externally, beyond the AWS account they grant access to. In contrast, to exploit role-based permissions, an attacker would need to gain persistent access to a specific instance to exploit the privileges assigned to it.

When credentials are embedded within compiled applications or other difficult-to-update systems, the likelihood of proper credential rotation decreases due to the potential service disruptions caused by updates. Over time, credentials that are not rotated become more susceptible to exposure, as they may be known to an increasing number of individuals, some of whom may no longer be employed by the organization.