August 7, 20262 min read

IAM Study Notes: Users, Groups & Roles

A student-friendly breakdown of AWS Identity and Access Management (IAM) identities.

In AWS, Identity determines who or what can interact with your resources. Think of IAM (Identity and Access Management) as the security guard that checks IDs before letting anyone into the building.

Key Concept: Policies

An identity doesn't do anything by itself; it needs Permissions. Permissions are defined in Policies, which specify:

What actions? (e.g., read data, delete bucket)
On which resources? (e.g., S3 Bucket A)
Under what conditions? (e.g., only from IP address X)

1. The Root User 🌟

When you create an AWS account, one special user is created automatically: the Root User.

Power Level: Infinite. It has full access to everything.
Risk: High. If this key is compromised, your entire account is at risk.
Best Practice: Use it only for initial setup tasks (like verifying payment). Lock it away afterward. Do not use it for daily work.

⚠️ Exam Tip: Never share root credentials. Always create individual users for team members.

2. IAM Users 👤

Definition: An identity tied to a specific person or application.

Long-term Access: Users have permanent credentials (passwords or long-term access keys).
Use Case: Your developer team, your CI/CD pipeline service account.
Structure: You can group users into Groups to manage permissions efficiently (e.g., "Developers" group gets read-only access).

Groups vs. Individual Policies

Instead of attaching policies to every single user, attach them to a Group. When you add a user to that group, they inherit those permissions. This makes management scalable.

3. IAM Roles 🎭

Definition: A temporary identity with no password. It's meant to be "assumed" by someone else.

Temporary Credentials: Roles provide short-lived security tokens.
Why use Roles? They are safer than sharing passwords and follow the principle of least privilege.
Common Use Cases:
1. Cross-Account Access: Letting Account B trust an entity from Account A.
2. Service Integration: Allowing AWS Lambda to write logs to CloudWatch. The Lambda function assumes a role to get permission.
3. Federation: Logging in via Google/Facebook/Azure AD. These external identities assume an IAM Role to enter AWS.

💡 Memory Aid:

User = Person/Long-term App

Role = Temporary Job Title / Task

Summary Table for Studying