IAM: Users, Roles & Policies

IAM (Identity and Access Management) controls who can do what across your entire AWS account. Almost every real AWS security incident traces back to an IAM mistake — an overly broad policy, a leaked key, or someone using the root account for daily work — so this is worth understanding before you touch anything else.

Users, groups, and roles

An IAM user is a long-term identity for a person or application, with its own credentials. A group is just a way to attach the same permissions to several users at once. A role is different — it's an identity that something (a person, or an AWS service like EC2 or Lambda) can temporarily assume, getting short-lived credentials instead of permanent ones.

bash terminal

aws iam list-users --query 'Users[].UserName'

Output

[
    "piyush",
    "ci-deploy-bot"
]

Policies: what permissions actually look like

A policy is a JSON document that grants or denies specific actions on specific resources:

JSON read-only-s3-policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:ListBucket"],
      "Resource": [
        "arn:aws:s3:::my-app-bucket",
        "arn:aws:s3:::my-app-bucket/*"
      ]
    }
  ]
}

What this grants

Read-only access to one specific bucket — nothing else. No write, no delete, no access to any other bucket in the account.

This is the shape of nearly every IAM policy: an Effect (Allow or Deny), a list of Actions, and a list of Resources those actions apply to.

The principle of least privilege: grant only the specific permissions something needs to do its job, nothing more. It's tempting to attach the broad AdministratorAccess policy to get unblocked quickly — but a compromised credential with admin access can do far more damage than one scoped to "read this one S3 bucket." If an explicit Deny exists anywhere in a matching policy, it always wins over any Allow, no matter how many other policies grant access.

Why the root account is dangerous to use daily

The root user (the one created when you first sign up for AWS) can do literally anything, including closing the account — and it can't be restricted by any policy. The standard practice is to use the root account exactly once, to create an IAM user with administrative permissions for yourself, enable MFA on root, and then never sign in as root again for day-to-day work.

PreviousIntroduction NextS3: Object Storage