IAM Roles Anywhere Test Credentials Issued Against Production Trust Anchor

The goal is to decide whether integration tests running outside AWS should use a dedicated IAM Roles Anywhere trust anchor and profile, separate from production, or whether credential reuse is acceptable when role session policies limit permissions.

AWS issues short-lived temporary credentials to workloads that present X.509 client certificates mapped to IAM roles. Published guidance does not define a mandatory revocation propagation latency or require certificate authority separation between test and production trust anchors. Behavior can vary by AWS Region and partition. Role permissions and resource policies remain the effective access boundary regardless of credential source.

Should test workloads use a distinct trust anchor and certificate authority from production? Which trust policy conditions prevent the test role from being assumed by production principals? What revocation latency makes test credentials unsafe after certificate compromise?