IAM Users
An IAM user is an identity created within an AWS account. Permissions can be assigned to control which AWS actions and resources the identity can access.
AWS IAM Tutorial
AWS IAM Users, Roles & Policies
Learn how AWS Identity and Access Management controls access to AWS resources. Understand IAM users, groups, roles, policies, permissions, trust relationships, and least privilege.
Level: Beginner
Service: AWS IAM
IAM Access Model
Identity + Permissions + Resources
Create or use an AWS identity
Define permissions with policies
Attach policies to identities
Authenticate and make a request
AWS evaluates permissions
Introduction
What is AWS IAM?
AWS Identity and Access Management, commonly called IAM, is used to manage access to AWS resources. IAM helps define who can access AWS and what actions they are permitted to perform.
AWS access is managed using identities and policies. IAM users, groups and roles can receive permissions through policies, while policies define the AWS actions and resources that can be accessed.
Understanding IAM is essential for building secure AWS environments because almost every AWS workload requires identity and permission management.
Core Concepts
Understand the main IAM components
IAM access management is built around identities, permissions and policies that control access to AWS resources.
IAM Groups
IAM groups help organize users and manage permissions for multiple users by attaching policies to the group.
IAM Roles
An IAM role is an identity with permissions that can be assumed by trusted principals. Roles provide temporary security credentials instead of standard long-term credentials.
IAM Policies
IAM policies are permission documents, commonly written in JSON, that define allowed or denied actions on AWS resources.
IAM Users
Understanding IAM users and permissions
An IAM user is an identity created inside an AWS account. A newly created IAM user does not automatically receive permission to perform AWS operations.
Permissions can be granted directly through policies or by adding users to IAM groups with the required permissions.
Example Permission Flow
IAM User
Represents a person or supported workload identity.
↓
IAM Policy
Defines allowed or denied actions and resources.
↓
AWS Resource Access
Access is evaluated based on applicable permissions.
IAM Roles
Use roles for temporary access
IAM roles provide permissions that can be assumed by trusted principals. When a role is assumed, temporary security credentials are provided for the role session.
EC2 Applications
Applications running on Amazon EC2 can use IAM roles to obtain temporary credentials for accessing supported AWS services.
Cross-Account Access
IAM roles can be used to provide access between AWS accounts without sharing long-term user credentials.
AWS Services
AWS services can assume roles to perform actions on other AWS resources when the required permissions are granted.
Federated Access
Federated identities can assume IAM roles to receive temporary permissions for accessing AWS resources.
IAM Policies
Different types of AWS IAM policies
Policies define permissions and can be associated with identities or supported AWS resources.
AWS Managed Policies
Predefined managed policies created and maintained by AWS that can be attached to supported IAM identities.
Customer Managed Policies
Reusable policies created and managed within your AWS account for more specific permission requirements.
Inline Policies
Policies embedded directly into a single user, group, or role and designed for a one-to-one relationship.
Resource-Based Policies
Policies attached directly to supported AWS resources that define which principals can access those resources.
Policy Structure
Understand IAM policy elements
IAM permission policies commonly use JSON documents containing statements that define allowed or denied actions on AWS resources.
Version
Identifies the policy language version used by the policy document.
Statement
Contains one or more permission statements that define access rules.
Effect
Specifies whether the statement allows or explicitly denies an action.
Action
Defines the AWS API actions that the policy controls.
Resource
Specifies the AWS resources to which the permissions apply.
Condition
Optionally defines additional conditions that must be satisfied for the policy statement to apply.
Example IAM Policy
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::example-bucket",
"arn:aws:s3:::example-bucket/*"
]
}
]
}IAM Architecture
How IAM identities receive access
AWS evaluates the identity making a request together with the applicable policies and resource permissions to determine whether access should be allowed or denied.
IAM roles also use trust policies to define which principals are permitted to assume the role.
Simplified IAM Architecture
AWS Account
│
├─────────────────────────────┐
│ │
▼ ▼
IAM User IAM Role
│ │
│ │
▼ ▼
IAM Policies Trust Policy
│ │
└──────────────┬──────────────┘
│
▼
AWS Permissions
│
▼
AWS ResourcesAWS CLI Examples
# Create an IAM user aws iam create-user \ --user-name developer-user # Create an IAM role aws iam create-role \ --role-name ExampleRole \ --assume-role-policy-document file://trust-policy.json # List IAM users aws iam list-users # List IAM roles aws iam list-roles
AWS CLI
Manage IAM from the command line
AWS CLI can be used to create and manage IAM users, roles, policies and other identity resources.
IAM administration requires appropriate permissions, so access should be granted carefully according to the responsibilities of the administrator or automation process.
Security Best Practices
Build a stronger IAM security model
Good IAM design focuses on limiting unnecessary access and managing permissions carefully as environments grow.
Follow Least Privilege
Grant only the permissions required to complete a specific task and avoid unnecessarily broad access.
Prefer Temporary Credentials
Use IAM roles and temporary credentials where appropriate instead of relying on long-term access credentials.
Use Groups for Shared Access
Manage permissions for users with similar responsibilities through groups where appropriate.
Review Permissions
Regularly review policies and access permissions to identify unnecessary or outdated access.
Protect Privileged Access
Apply stronger security controls to highly privileged identities and administrative access.
Use Specific Resources
Where supported, limit policies to the specific AWS resources required instead of using unrestricted wildcards.
What You Will Learn
Build your AWS IAM foundation
Understand IAM Identities
Learn the differences between IAM users, groups and roles.
Manage AWS Permissions
Understand how IAM policies define access to AWS actions and resources.
Use IAM Roles
Learn why roles are used for temporary permissions, AWS services and delegated access.
Apply IAM Security Practices
Understand least privilege, permission review and secure access management concepts.
Continue Learning
Explore more AWS tutorials
Next Step
Continue learning AWS security and access management
You now understand the foundation of IAM users, roles and policies. Continue exploring AWS services to learn how identity, permissions and security are applied across cloud infrastructure.