Users, Groups & Roles
Users are people or apps, groups bundle users together, and roles grant temporary permissions to whoever assumes them.
IAM offers three kinds of identity. Choosing the right one is a security decision.
Users
An IAM user represents one person or application and has long-lived credentials (a password and/or access keys). Best for humans and legacy apps.
Groups
A group is just a set of users. Attach a policy to the group and every member inherits it. Manage permissions by group, not per user.
Roles
A role has permissions but no permanent credentials. Anyone (or any service) that is trusted can assume the role and receive temporary keys that expire automatically. This is the preferred way to give an EC2 instance or Lambda function access to other services.
When to use a role
- An EC2 instance needs to read from S3.
- A Lambda function needs to write to DynamoDB.
- A user in one account needs temporary access to another account.
Example
# Create a group and attach a managed policy to it
aws iam create-group --group-name Developers
aws iam attach-group-policy --group-name Developers \
--policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
# Create a user and add them to the group
aws iam create-user --user-name alice
aws iam add-user-to-group --user-name alice --group-name DevelopersWhen to use it
- A team of five developers is placed in a 'Developers' IAM group so that a single policy change grants or revokes permissions for all of them.
- A Lambda function assumes an IAM role to read from an S3 bucket, never needing a long-lived access key stored in code.
- An on-premises server uses an IAM role with STS AssumeRole to temporarily access an S3 bucket for nightly backup uploads.
More examples
Create User and Add to Group
Creates an IAM user, a group, and adds the user to the group — the standard pattern for managing team permissions.
aws iam create-user --user-name bob
aws iam create-group --group-name Developers
aws iam add-user-to-group \
--user-name bob \
--group-name DevelopersCreate an IAM Role for Lambda
Creates a role that Lambda can assume, enabling the function to call AWS services without hard-coded credentials.
aws iam create-role \
--role-name LambdaExecRole \
--assume-role-policy-document '{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Principal": {"Service": "lambda.amazonaws.com"},
"Action": "sts:AssumeRole"
}]
}'Assume a Role via STS
Demonstrates assuming an IAM role to obtain short-lived credentials, the preferred alternative to long-lived access keys.
aws sts assume-role \
--role-arn arn:aws:iam::123456789012:role/DeployRole \
--role-session-name deploy-session \
--query 'Credentials.{Key:AccessKeyId,Expiry:Expiration}' \
--output table
Discussion