One question related to AWS is how to, or whether it is worth, segmenting access to resources for containers. If you are using single instances for each service

One question related to AWS is how to, or whether it is worth, segmenting access to resources for containers. If you are using single instances for each service you can use instance roles for this. These are great as they are temporary, tied to the machine, and most of the client libraries will detect them automatically. If you are using containers, you need to create proper users presumably. Or you need to give all the permissions to the instance. Maybe this isn't a problem in practice because people group related services together into separate orchestration clusters (i.e. a Kubernetes for each service grouping). But it would be great to hear some real experiences on this.