What is IAM?
AWS Identity and Access Management controls who can sign in and what they are allowed to do.
IAM (Identity and Access Management) is the service that decides who can do what in your AWS account. It is free and central to everything else.
Core building blocks
- Users — a person or application identity with long-term credentials.
- Groups — a collection of users that share permissions.
- Roles — a temporary identity that services or users can assume.
- Policies — JSON documents that grant or deny permissions.
Nothing is allowed by default. Access is granted only when a policy explicitly permits it.
Example
# List the IAM users in your account
aws iam list-users --query "Users[].UserName" --output table
# See which policies are attached to a user
aws iam list-attached-user-policies --user-name aliceWhen to use it
- A company uses IAM to ensure only the finance team can access billing dashboards, while developers only access EC2 and Lambda.
- A CI/CD pipeline authenticates to AWS using an IAM role with only the permissions it needs to deploy a Lambda function.
- An auditor reviews IAM policies to verify that no human user has access to production databases without going through a bastion role.
More examples
List IAM Users in Account
Lists all IAM users in the account, showing names and creation dates to audit who has direct credentials.
aws iam list-users \
--query 'Users[].{Name:UserName,Created:CreateDate,Arn:Arn}' \
--output tableShow Policies Attached to a User
Shows which managed IAM policies are directly attached to a user, clarifying what permissions they hold.
aws iam list-attached-user-policies \
--user-name alice \
--query 'AttachedPolicies[].{Name:PolicyName,Arn:PolicyArn}' \
--output tableGet IAM Summary for Account
Returns a high-level count of IAM entities in the account, useful for a quick security audit of IAM scale.
aws iam get-account-summary \
--query 'SummaryMap.{Users:Users,Groups:Groups,Roles:Roles,Policies:Policies}' \
--output table
Discussion