IAM: Users, Groups & Roles

IAM Overview

AWS Identity and Access Management (IAM) lets you control who can access your AWS resources and what they can do.

Key Concepts

• Users – individual people or services with long-term credentials
• Groups – collections of users sharing the same permissions
• Roles – temporary credentials assumed by services or federated users
• Policies – JSON documents that define allowed/denied actions

Best Practices

• Follow the principle of least privilege
• Enable MFA for all human users
• Prefer roles over access keys for EC2/Lambda
• Rotate access keys regularly