AWS IAM Explained: Users, Groups, and Roles

Binamra Pandey — Sun, 30 Aug 2026 15:13:40 +0000

What is IAM Users and Groups?

First, let's understand what IAM is in AWS. IAM stands for Identity and Access Management, and it is a service in AWS that lets us control who can access what kind of resources in our AWS account.

Now that we know what IAM is, let's talk about Users and Groups.

An IAM User is an identity you create for a person or application that needs to interact with your AWS account. Each user gets their own credentials, so you know exactly who did what.

An IAM Group is simply a collection of users. Instead of assigning permissions to each user one by one, you can put users into a group and assign permissions to the group. Every user in that group automatically gets those permissions.

For example, if you have five developers who all need the same access to S3, you don't attach the policy five times. You create a "Developers" group, attach the policy once, and add all five users to it.

Why is IAM necessary

Without IAM, anyone with access to your AWS account would have full control over everything in it. If you want to share your aws account or have another user for different purposes you don't have share your root user account instead, you can create a completely new users for specific purpose and attached that user with required permission to perform that specific task only.

Creating a IAM user

To create a IAM user for your aws, login to your (root) account. And Search for IAM in the search bar.

After that where you are inside IAM dashboard, click on IAM users and when IAM users page loads successfully, click on Create User

After you click on create user, you'll be asked to enter some information regarding this new user.

Afer that, you'll be asked to set permission for the new user. Here, you'll have 3 options. You can either attach your this newly created IAM user to the group or copy all the permission from another user. Or you can also set inline attach policy directly to the user.

P.S: An inline policy is a policy that's embedded directly into a single IAM user, group, or role, rather than existing as a separate, standalone policy.

When you set permission for this user, you'll be asked to review them and finally you can create the IAM user.

This is how you can create IAM user.

Creating IAM group

Now, to create a IAM group, from the IAM dashboard click on IAM users group. Type the name of your group and attach the required permission policies

After that, click on create group button, it'll create that group for you.

You can assign multiple users to single groups depending on the required permission.

IAM Roles for services

An IAM Role is similar to an IAM user in the sense that it's an identity with permissions attached to it, but it doesn't have permanent credentials like a username and password. Instead, a role is assumed temporarily by whoever or whatever needs it, and AWS hands out short term credentials that expire automatically.

This is mainly used when a service, like EC2 or Lambda, needs to access other resources in your aws account.

For example, say you have an EC2 instance running an application that needs to read files from an S3 bucket. You could create an IAM user, generate access keys and hardcode them into your application, but this isn't a good practice since those keys don't expire and if your instance ever gets compromised, the attacker gets those same keys too.