AWS IAM Users and Permissions

IAM (Identity and Access Management) controls who can use your AWS account and what they are allowed to do.

Why IAM Matters

Imagine a small software house in Karachi with five staff. The designer only needs to upload images to S3. The developer needs to start servers. The accountant only needs to see the bill. Giving everyone the root password would be dangerous.

With IAM, each person gets their own login with only the permissions they need. IAM itself is free.

IAM Building Blocks

Policies

A policy is written in JSON. This one lets someone read files from one bucket only:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:ListBucket"],
      "Resource": [
        "arn:aws:s3:::shop-images",
        "arn:aws:s3:::shop-images/*"
      ]
    }
  ]
}

The parts explained:

• Effect: Allow or Deny
• Action: which API actions, written as service:Action
• Resource: which item, using its ARN (Amazon Resource Name)

Rules to remember:

1. By default, everything is denied
2. An Allow gives permission
3. An explicit Deny always wins over any Allow

AWS also gives ready-made AWS managed policies, like AmazonS3ReadOnlyAccess or AdministratorAccess.

Creating a User and Group with the CLI

Create a group, attach a managed policy, then create a user and put them in the group:

aws iam create-group --group-name developers
aws iam attach-group-policy --group-name developers \
  --policy-arn arn:aws:iam::aws:policy/AmazonEC2FullAccess
aws iam create-user --user-name ali
aws iam add-user-to-group --user-name ali --group-name developers

Check which groups Ali is in:

aws iam list-groups-for-user --user-name ali --query "Groups[].GroupName"

[
    "developers"
]

Roles

A role has permissions but no password. Someone or something "assumes" the role and gets temporary credentials.

Common uses:

• An EC2 instance that needs to read from S3. You attach a role to the instance, so you never store access keys on the server.
• A Lambda function that writes to DynamoDB.
• A user from another AWS account who needs temporary access.

Temporary credentials expire automatically, which makes roles safer than access keys.

Least Privilege

The principle of least privilege means: give only the permissions needed for the job, and nothing more. Start with small permissions and add more when there is a real need.

Good IAM Habits

• Turn on MFA for the root user and for every human user
• Use the root user only for a few account tasks, never daily
• Give each person their own user; never share logins
• Prefer roles over long-term access keys
• Rotate (replace) access keys regularly and delete unused ones
• Use the IAM Access Analyzer and the credential report to find unused permissions

You can list access keys for a user to check how old they are:

aws iam list-access-keys --user-name ali

{
    "AccessKeyMetadata": [
        {
            "UserName": "ali",
            "AccessKeyId": "AKIAEXAMPLEKEY",
            "Status": "Active",
            "CreateDate": "2026-03-01T09:15:00Z"
        }
    ]
}

Exercise