An execution role is the cloud identity assigned to a runtime, such as a container, serverless function, or managed AI agent, so it can call services and access resources. Instead of using a human login, the workload receives temporary credentials tied to that role. Those credentials define what the runtime can read, write, start, delete, or delegate.
Execution roles matter because they are a major trust boundary in cloud security. If the role is overprivileged, a single compromised workload can reach storage buckets, databases, queues, secrets, or management APIs. Attackers often try to abuse this by exploiting code execution, prompt injection, or metadata credential access inside the runtime. Defenders reduce risk by applying least privilege, separating roles by task, restricting credential access paths, and monitoring role usage for unusual calls.