Benefit of using IAM roles

[hakanensari]

I am trying to wrap my head around why the documentation recommends using an IAM role when hitting the Selling Partner API.

I have seen mentions of security and the impact of lost keys, but I do not quite get it. Are we not storing user credentials in the app either way—we still need a user to hit the token service to assume a role?

Also, if STS is after all helpful in all use cases, would it help to cache the temporary tokens provided by STS to reduce the overhead of hitting it each time before making a request to the Selling Partners API?

Any pointers to best practices?