AWS for DevOps — IAM Users & Groups

2.1 — IAM Users & Groups

Every person who interacts with your AWS account should have their own IAM user. Groups let you manage permissions for many users at once instead of attaching policies to each user individually.

Root Account vs IAM User

When you first create an AWS account you get a root user. Think of it as the master key to your house — it can do everything, including closing the account.

Aspect	Root User	IAM User
Created	Automatically with account	Manually by an admin
Permissions	Unlimited — cannot be restricted	Only what policies allow
MFA	Must enable immediately	Should enable for humans
Daily use	Never	Yes
Can close account	Yes	No

Rule #1: Lock down the root account. Enable MFA, delete its access keys, and never use it again.

Creating an IAM User (Console)

1. IAM → Users → Create user
2. Enter a user name (e.g., deploy-bot)
3. Choose access type:
   • Console access — for humans who need the web UI
   • Programmatic access — generates Access Key ID + Secret Access Key for CLI / SDK
4. Attach permissions (via a group or directly)
5. Review → Create user
6. Download the CSV with credentials — you will never see the secret key again

Creating an IAM User (CLI)

# Create a user
$ aws iam create-user --user-name deploy-bot
{
    "User": {
        "UserName": "deploy-bot",
        "Arn": "arn:aws:iam::123456789012:user/deploy-bot",
        "CreateDate": "2026-03-30T05:00:00Z"
    }
}

# Create programmatic access keys
$ aws iam create-access-key --user-name deploy-bot
{
    "AccessKey": {
        "UserName": "deploy-bot",
        "AccessKeyId": "AKIAIOSFODNN7EXAMPLE",
        "SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
        "Status": "Active"
    }
}

Important: Store the secret access key in a password manager. If you lose it, you must create a new key pair.

IAM Groups

A group is simply a collection of users. You attach policies to the group, and every user in that group inherits those permissions.

  ┌── Group: Developers ───────────────────┐
  │   Policy: ReadOnlyAccess               │
  │   Policy: S3FullAccess                 │
  │                                        │
  │   user: alice                          │
  │   user: bob                            │
  │   user: charlie                        │
  └────────────────────────────────────────┘

  ┌── Group: DevOps ───────────────────────┐
  │   Policy: AdministratorAccess          │
  │                                        │
  │   user: deploy-bot                     │
  │   user: sysadmin                       │
  └────────────────────────────────────────┘

Creating a Group and Adding a User (CLI)

# Create a group
$ aws iam create-group --group-name Developers
{
    "Group": {
        "GroupName": "Developers",
        "GroupId": "AGPA1234567890EXAMPLE",
        "Arn": "arn:aws:iam::123456789012:group/Developers"
    }
}

# Attach a managed policy to the group
$ aws iam attach-group-policy \
    --group-name Developers \
    --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

# Add a user to the group
$ aws iam add-user-to-group \
    --group-name Developers \
    --user-name alice

List Users and Groups

# List all users
$ aws iam list-users --query 'Users[*].UserName'
[
    "alice",
    "bob",
    "deploy-bot"
]

# List groups for a user
$ aws iam list-groups-for-user --user-name alice --query 'Groups[*].GroupName'
[
    "Developers"
]

# List users in a group
$ aws iam get-group --group-name Developers --query 'Users[*].UserName'
[
    "alice",
    "bob",
    "charlie"
]

Real-World Analogy

Think of IAM like a company’s building access system:

• Each employee (IAM user) gets their own badge
• Departments (groups) define which floors you can access
• The CEO’s master key (root account) is locked in a safe and only used in emergencies

Common Mistakes

Mistake	Why It Hurts	Fix
Sharing one IAM user across a team	No accountability — you cannot tell who did what	One user per person
Attaching policies directly to users	Hard to manage at scale	Use groups instead
Using root account for daily work	Single point of catastrophic failure	Create an admin IAM user
Not rotating access keys	Old keys can be leaked or forgotten	Rotate every 90 days

Quick Reference

Task	Command
Create user	aws iam create-user --user-name NAME
Create access key	aws iam create-access-key --user-name NAME
Create group	aws iam create-group --group-name NAME
Attach policy to group	aws iam attach-group-policy --group-name NAME --policy-arn ARN
Add user to group	aws iam add-user-to-group --group-name NAME --user-name NAME
List users	aws iam list-users
Delete user	aws iam delete-user --user-name NAME

---

Next → IAM Roles