IAM Users and Groups
By the end of this lesson, you'll be able to:
- Explain what an IAM user represents and why long-lived user credentials carry management risk
- Explain how IAM groups assign shared permissions to collections of users
- Decide whether a group, rather than per-user configuration, fits a given scenario
Prerequisites: "What Is IAM?"
What an IAM user is
An IAM user is an identity that exists within your AWS account — typically representing one specific person. A user can be given permissions directly, or (much more commonly, and covered next) through membership in a group.
Two things worth internalizing early: users don't automatically receive broad permissions just by existing — every permission has to be deliberately granted — and a user's credentials (a password for Console access, or access keys for programmatic access, covered in Lesson 6) are long-lived by default. Long-lived credentials sitting around indefinitely are a bigger management risk than credentials that expire quickly, simply because there's more time for something to go wrong with them — get lost, get exposed, or get forgotten and left active long after they're needed.
One user per application is not the goal
It's tempting to think of an IAM user as the default way to give anything — a person or an application — access to AWS. For actual workloads (an application running on a server, a scheduled job, a piece of code calling AWS on its own), a user with long-lived access keys is usually the wrong tool. Lesson 3 introduces IAM roles, which give workloads temporary, automatically-rotating credentials instead — the direction this course steers you toward for anything that isn't a human logging in.
For now, the takeaway is narrower: reach for a human IAM user when a person needs to sign in and work with AWS directly, and hold off on deciding how a workload gets access until roles are on the table.
Groups: shared permissions without repetition
An IAM group is a collection of IAM users that share a set of permissions. Instead of attaching the same policy to five different developers one at a time, you attach it once to a Developers group and add each developer to that group — every member inherits the group's permissions.
Two structural rules worth knowing: groups contain users, but a group cannot contain another group. And a group is not the same thing as a role, even though both involve permissions — a group is a way of organizing users; a role (next lesson) is its own kind of identity, one that gets assumed rather than logged into.
Exercise
Five developers on a team all need the same baseline set of permissions to do their jobs. Would you configure each developer's permissions individually, or use a group? Explain what would go wrong with the alternative approach as the team grows to fifteen people.
Show hint
Think about what happens when that baseline permission set needs to change later, under each approach.
IAM Users and Groups Quiz
My Notes
Log in to keep private notes on this lesson.
Questions about this lesson
No questions yet — be the first to ask.
Log in to ask a question about this lesson.
Summary
An IAM user is an identity within an AWS account that can be granted permissions directly or through group membership; IAM groups let a shared set of permissions be assigned to many users at once, rather than configuring each user individually.