AWS IAM — Users, Roles & Permissions
Who can do what, to which resources — the control system behind every secure AWS account.
IAM (Identity and Access Management) is how AWS decides who is allowed to do what. Get IAM right and your account is secure; get it wrong and you’ve handed the keys to attackers. It’s free, and it’s the first thing to master in any cloud.
🎯 Learning Objectives
By the end of this lesson you will:
- Understand IAM users, groups, roles, and policies
- Apply the principle of least privilege
- Understand why roles beat long-lived keys
- Configure the AWS CLI
The Four IAM Building Blocks
| Concept | What it is |
|---|---|
| User | A person or app with long-term credentials |
| Group | A collection of users sharing permissions (e.g. Developers) |
| Policy | A JSON document that grants or denies specific actions |
| Role | A set of permissions that can be assumed temporarily — by a user, service, or EC2 instance |
Policies: the Rules Themselves
A policy is JSON that says which actions are allowed on which resources:
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": ["s3:GetObject", "s3:ListBucket"],
"Resource": "arn:aws:s3:::my-app-bucket/*"
}]
}This policy allows reading objects from one specific bucket — and nothing else.
💡 Principle of Least Privilege
Grant only the permissions actually needed to do the job — no more. Start with nothing and add access as required, rather than granting broad access and hoping to lock it down later.
Roles Beat Long-Lived Keys
A common mistake is storing an access key on a server. Instead, attach an IAM role to the EC2 instance — AWS then hands it short-lived, auto-rotating credentials.
⚠ Never do this
Never hard-code AWS access keys in your code, commit them to Git, or bake them into an EC2 instance. Leaked keys are one of the most common causes of cloud breaches. Use roles for services and short-lived credentials for humans.
Configure the AWS CLI
aws configure
# AWS Access Key ID: ****************
# AWS Secret Access Key: ****************
# Default region name: eu-west-1
# Default output format: jsonaws sts get-caller-identity is the “whoami” of AWS — it confirms which identity your CLI is using.
🧪 Hands-on Lab
Create a Least-Privilege User
In the AWS Console:
- Enable MFA on your root account (then stop using root for daily work).
- Create an IAM group called
Developers. - Attach a policy that grants only what’s needed (e.g. read-only S3).
- Create a user, add them to the group, and test with the CLI.
🧠 Knowledge Check
What is the principle of least privilege?
How should an EC2 instance access an S3 bucket securely?
💼 Interview Preparation
Why are IAM roles preferred over IAM user access keys for applications?
Summary
You now understand IAM users, groups, roles, and policies, the principle of least privilege, and why roles beat static keys. Next, you’ll launch your first virtual server with EC2.