IAM — Users, Groups, Roles, Policies

The 4 entities (corrected model)

IAM User   = a PERSON (permanent login + keys) — human or long-term app
IAM Group  = a LIST of USERS sharing policies (users ONLY, never roles)
IAM Role   = TEMPORARY permission set — assumed by users OR services (via STS)
IAM Policy = the JSON permissions → attached to user / group / role

Entity	For	Lifetime
User	People (console login, access keys)	Permanent
Group	Batch-manage user permissions	Permanent
Role	Services (EC2/Lambda) + cross-account + humans temporarily	Temporary (STS: 15min-12h)
Policy	Define allow/deny rules	Permanent

Key exam patterns

Human needs console access  → USER (add to GROUP for permissions)
EC2/Lambda needs access     → ROLE (assumed, NO keys stored on instance)
Many users, same perms      → GROUP (users only)
Service compromised         → role creds expire; keys don't

The roles rule (memorize):

• EC2/Lambda/ECS → attach IAM Role → temporary creds via STS → access other services
• NEVER put access keys in code or on the instance

Policy JSON structure

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["s3:GetObject", "s3:ListBucket"],
    "Resource": "arn:aws:s3:::my-bucket/*"
  }]
}

• Effect: Allow / Deny (Deny WINS over Allow)
• Action: API calls (s3:*, ec2:RunInstances)
• Resource: ARN (arn:aws:s3:::bucket/*)
• Optional Condition: time, IP, MFA
• ARN: arn:aws:service:region:account:resource

Policy types

• Identity-based: on user/group/role (“what can alice do”)
• Resource-based: on resource (“who can access this bucket/queue”)
• SCP (Organizations): account-level boundary
• Permission boundary: max ceiling for a role/user

Best practices (exam)

• Least privilege (only what’s needed)
• MFA on root account (mandatory) + users
• Root only for account setup — then use admin users
• No access keys on EC2 — roles
• Audit with CloudTrail

Exam Q mapping

Scenario	Answer
EC2 needs S3 access	IAM Role (not keys)
Lambda needs DynamoDB	IAM Role
Dev needs console	IAM User + group
Attach policy to many users	Group
Temporary credentials	Role + STS
Protect root	MFA

Related

• [[aws/index]]
• [[aws/security-services/index]]
• [[aws/organizations/index]]