Skip to content

Beginner · AWS account, IAM and billing · topic 7 of 50 · 30 min

IAM: users, groups, roles and least privilege

Explanation

IAM (Identity and Access Management) decides who can do what in your AWS account. Users and groups are for long-term identities, roles give temporary credentials to services and people, and policies list the allowed actions. Give each identity only the permissions it needs (least privilege), turn on MFA, and never put access keys in code.

Two questions: who are you, and what may you do?

Authentication answers "who are you?": a password plus an MFA code, or an access key. Authorisation answers "what are you allowed to do?": for example read files in one S3 bucket but not delete servers. IAM, Identity and Access Management, handles both for AWS. It is a global service (not tied to one region) and costs nothing extra.

Think of it like this: Think of an office building. Your ID card proves who you are at the gate: that is authentication. The list of floors your card opens is authorisation. A visitor gets a temporary pass that stops working in the evening: that is an IAM role with temporary credentials.

Identities

IdentityWhat it isCredentialsUse it for
IAM userOne person or program with long-term credentialsPassword and/or access keys (long-term)Learning accounts, rare legacy cases
IAM groupA collection of users that share permissionsNone of its own; you cannot sign in as a groupGiving "developers" or "auditors" the same rights
IAM roleAn identity anyone trusted can assume for a whileTemporary credentials from STSEC2, Lambda, other accounts, people through Identity Center

Groups cannot contain other groups. A user can be in several groups and gets the permissions of all of them, plus any attached to the user directly.

Policies

A policy is a JSON document that lists permissions. Identity-based policies attach to a user, group or role and say what that identity may do. Resource-based policies attach to a resource, such as an S3 bucket policy, and say who may use that resource. Policies come in three flavours: AWS managed (written and updated by AWS, such as ReadOnlyAccess or AmazonS3ReadOnlyAccess), customer managed (written by you, reusable), and inline (embedded in one identity; avoid unless you need a strict one-to-one link). The next topic reads policy JSON line by line.

Roles and temporary credentials

A role has two parts: a trust policy (who may assume the role) and permission policies (what the role may do). When an EC2 server needs to read from S3, you do not copy access keys onto it. You create a role that trusts the EC2 service, attach it to the server through an instance profile (a small wrapper that connects a role to an EC2 instance), and the server automatically receives temporary credentials from STS, the AWS Security Token Service. They expire and are rotated for you. Lambda functions get a role, called an execution role, in the same way.

Good habits

  • Least privilege: give only the actions and resources a job needs. Start small and add when something is truly needed.
  • MFA for every person who signs in, especially admins.
  • People sign in through IAM Identity Center, which gives short-term credentials and one place to remove a leaver's access.
  • Access keys (an access key ID starting with AKIA plus a secret) only when nothing else works. Rotate them, delete unused ones, and never commit them to Git. Temporary keys from STS start with ASIA.
  • IAM Access Analyzer finds resources shared with outside accounts, flags unused permissions, and checks your policies for mistakes.
bash
aws iam create-group --group-name developers
aws iam attach-group-policy --group-name developers \
    --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess
aws iam create-user --user-name ravi
aws iam add-user-to-group --user-name ravi --group-name developers
aws iam list-attached-group-policies --group-name developers
Create a group, give it an AWS managed policy, and add a user. ravi now inherits read-only access.
Careful: Common mistakes: (1) Giving everyone AdministratorAccess "to save time". (2) Attaching policies to each user one by one instead of to a group, so nobody can tell who has what. (3) Putting access keys in code, a .env file pushed to GitHub, or a WhatsApp message. Bots scan public repositories for keys within minutes. If a key leaks, deactivate it at once, check CloudTrail for what it did, and create a new one. (4) Copying keys onto EC2 instead of using a role.
Tip: Name things so a stranger understands them: a group called "billing-readers" or a role called "results-portal-ec2-read-s3" explains itself in an audit.

Need help?

Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.

Try:

Watch the lesson

IAM: users, groups, roles and least privilege · 1/6

IAM

IAM, identity and access management, decides who can do what in your AWS account.

Prefer a video by a teacher? Find free videos on “AWS IAM users groups roles policies tutorial for beginners” on YouTube ↗

In real life: A BPO gives each team the right access

A BPO in Gurugram runs its call-recording app on AWS. Agents never touch AWS. Developers are in a "developers" group with permission to deploy only to the development account. Two senior engineers have admin rights in production through IAM Identity Center, with MFA, and their sessions expire after a few hours. The recording servers run on EC2 with a role that can write only to the "call-recordings" bucket. When a developer leaves, HR's exit checklist removes one Identity Center user, and all access ends at once.

Practice (0/3 done)

Task 1 · Question

An EC2 server must read files from one S3 bucket. What is the safest way to give it access?

Task 2 · Code · Python

A user's effective permissions are the actions attached to the user directly plus the actions of every group the user belongs to. users looks like {"ravi": {"groups": ["developers"], "actions": ["s3:GetObject"]}} and groups looks like {"developers": ["ec2:DescribeInstances", "s3:GetObject"]}. Write effective_actions(user, users, groups) that returns a sorted list with no duplicates.

Task 3 · Code · Python

Policies often use wildcards: "s3:Get*" matches s3:GetObject and s3:GetBucketPolicy, and "*" matches everything. Write is_allowed(user, action, users, groups) that returns True if ANY of the user's effective actions (direct plus groups, as in the previous task) matches action. AWS ignores upper and lower case in action names, so compare in lower case. Use fnmatch.fnmatchcase from the standard library for the wildcard match.

Quick quiz

Question 1

1.Which IAM identity gives temporary credentials and is the right choice for a Lambda function?

Question 2

2.Can you sign in to AWS as an IAM group?

Question 3

3.Which is "authorisation"?

Question 4

4.You find an access key in a public GitHub repo. What do you do FIRST?

Question 5

5.Which tool finds resources shared with outside accounts and unused permissions?

Read more (free)

Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.

Which IAM identity gives temporary credentials and is the right choice for a Lambda function?

Answer: IAM role

Lambda runs with an execution role; AWS supplies temporary credentials.

Can you sign in to AWS as an IAM group?

Answer: No, a group only holds users and their shared permissions

Groups have no credentials of their own; they only collect users.

Which is "authorisation"?

Answer: Deciding whether a signed-in user may delete a bucket

Authorisation is about what an identity is allowed to do; the others prove who you are.

You find an access key in a public GitHub repo. What do you do FIRST?

Answer: Deactivate the key immediately

Deactivate it at once, then check CloudTrail for what it did and create a new key.

Which tool finds resources shared with outside accounts and unused permissions?

Answer: IAM Access Analyzer

IAM Access Analyzer reports external access, unused access and policy problems.

Why are roles with temporary credentials better than access keys for apps?Related

Answer: Credentials expire automatically, so a leak is useful for a short time only

Short-lived credentials shrink the window of misuse.

From Cloud identity and access management

Developers may create their own IAM roles, but never more powerful than a set limit. What enforces that limit?Related

Answer: A permissions boundary

A permissions boundary caps the permissions of the users or roles it is set on.

From Identity is the new perimeter

What is least privilege?Related

Answer: Each account gets only the access its job needs

Minimum access limits damage when an account is misused.

From Identity and access management, least privilege and RBAC

Which value should "Version" have in a new IAM policy?Related

Answer: "2012-10-17"

"2012-10-17" is the current policy language version.

From IAM policy JSON and how AWS decides

Pass the quiz (60% or more) or mark this topic as done when you are ready.

Your progress is saved on this device only.

Next: IAM policy JSON and how AWS decides →

Next steps

  1. 2 more topics in “AWS account, IAM and billing” before its exam: IAM policy JSON and how AWS decides, Pricing, billing and cost control.
  2. Module 2 exam: AWS account, IAM and billing · 13 questions · 20 min, without help. 4 topics of this module still to finish first.
  3. Then the next module, Compute and storage: EC2 and S3. 50 topics left in the course before the final exam.

← Previous: Creating and securing an AWS account