IAM Users and Groups

IAM users and groups are the primary way you grant people and applications access to your AWS account. Understanding how to create, organise, and manage them is fundamental to maintaining a secure environment.

---

IAM Users

An IAM user is an entity that represents a person or workload. When you create a user, you give it a unique name and assign it credentials so it can authenticate.

Types of Access

Each IAM user can have one or both types of access:

Access Type	Used For	Credential
Console access	Signing in to the AWS Management Console via a web browser	Password
Programmatic access	Making API calls via the CLI, SDKs, or direct HTTP requests	Access key ID + Secret access key

A user with console access can click through the AWS web interface. A user with programmatic access can run commands like aws s3 ls from a terminal. Many users — especially administrators — have both.

Creating an IAM User

When creating a user, you should:

1. Choose a meaningful username — typically matching the person's corporate identity (e.g., jsmith, maria.garcia).
2. Set a strong initial password — and require the user to change it on first sign-in.
3. Enable MFA — add multi-factor authentication as soon as the user is created.
4. Attach permissions — either directly or (preferably) through group membership.

Access Keys

Access keys consist of two parts:

• Access Key ID — a 20-character alphanumeric string (e.g., AKIAIOSFODNN7EXAMPLE)
• Secret Access Key — a 40-character string shown only at creation time

Important: The secret access key is shown exactly once. If you lose it, you must create a new access key pair. Never share access keys. Never embed them in source code. Never commit them to version control.

Each user can have a maximum of two active access keys. This allows you to rotate keys without downtime — create a new key, update your applications, then deactivate the old key.

---

IAM Groups

An IAM group is simply a collection of IAM users. Groups let you manage permissions collectively rather than individually.

Why Use Groups?

Imagine you have 20 developers who all need the same permissions. Without groups, you would:

• Attach the same policies to each of the 20 users individually
• When permissions change, update all 20 users one by one
• When a new developer joins, remember exactly which policies to attach

With groups, you:

• Create a Developers group and attach policies to it once
• Add each developer to the group — they automatically inherit the permissions
• When permissions change, update the group — all 20 users are updated instantly
• When a new developer joins, add them to the group — done

Group Rules and Limitations