IAM users and groups in AWS - Commands & Configuration

Introduction

Managing who can access your cloud resources is important. IAM users and groups help you organize and control permissions for people using your AWS account.

When you want to give a new employee access to AWS resources with specific permissions.

When you need to manage permissions for a team working on the same project.

When you want to avoid sharing your root account credentials for security.

When you want to apply the same permissions to multiple users easily.

When you want to track who performed actions in your AWS account.

Commands

This command creates a new group named 'Developers' to organize users with similar permissions.

Terminal

aws iam create-group --group-name Developers

Expected Output

{"Group":{"Path":"/","GroupName":"Developers","GroupId":"AGPAEXAMPLEID","Arn":"arn:aws:iam::123456789012:group/Developers","CreateDate":"2024-06-01T12:00:00Z"}}

→

--group-name - Specifies the name of the group to create.

This command creates a new IAM user named 'alice' who can be given permissions to access AWS resources.

Terminal

aws iam create-user --user-name alice

Expected Output

{"User":{"Path":"/","UserName":"alice","UserId":"AIDAEXAMPLEID","Arn":"arn:aws:iam::123456789012:user/alice","CreateDate":"2024-06-01T12:01:00Z"}}

→

--user-name - Specifies the name of the user to create.

This command adds the user 'alice' to the 'Developers' group so she inherits the group's permissions.

Terminal

aws iam add-user-to-group --user-name alice --group-name Developers

Expected Output

No output (command runs silently)

→

--user-name - Specifies the user to add to the group.

→

--group-name - Specifies the group to add the user to.

This command lists all groups that the user 'alice' belongs to, confirming the user is in the 'Developers' group.

Terminal

aws iam list-groups-for-user --user-name alice

Expected Output

{"Groups":[{"Path":"/","GroupName":"Developers","GroupId":"AGPAEXAMPLEID","Arn":"arn:aws:iam::123456789012:group/Developers","CreateDate":"2024-06-01T12:00:00Z"}]}

→

--user-name - Specifies the user whose groups are listed.

Key Concept

If you remember nothing else from this pattern, remember: IAM groups let you manage permissions for many users at once by adding users to groups.

Common Mistakes

Trying to assign permissions directly to a user without using groups.

This makes managing permissions harder when you have many users because you must update each user separately.

Create groups with the needed permissions and add users to those groups.

Using the root AWS account for daily tasks instead of IAM users.

The root account has full access and using it increases security risks.

Create IAM users with limited permissions for daily use.

Not verifying that a user was added to a group after running the add-user-to-group command.

You might think the user has permissions when they do not, causing access errors.

Run 'aws iam list-groups-for-user' to confirm group membership.

Summary

Create IAM groups to organize users with similar permissions.

Create IAM users for each person who needs access.

Add users to groups to grant them the group's permissions.

Verify group membership to ensure permissions are applied.