IAM users and groups in AWS - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is an IAM user in AWS?

An IAM user is an identity that represents a person or service who interacts with AWS. It has credentials to access AWS resources securely.

beginner

What is the purpose of an IAM group?

An IAM group is a collection of IAM users. It helps manage permissions by assigning policies to the group instead of individual users.

intermediate

How do IAM groups simplify permission management?

By assigning permissions to a group, all users in that group inherit those permissions. This avoids setting permissions one by one for each user.

intermediate

Can IAM users belong to multiple groups?

Yes, an IAM user can be a member of multiple groups, inheriting permissions from all those groups combined.

advanced

What is the difference between IAM user permissions and group permissions?

User permissions are policies attached directly to a user. Group permissions come from policies attached to groups the user belongs to. Both combine to define effective permissions.

What does an IAM group in AWS primarily help with?

A Managing multiple users' permissions together

B Creating new AWS accounts

C Storing data securely

D Running applications

IAM groups help manage permissions for multiple users by grouping them and assigning policies to the group.

Can an IAM user exist without belonging to any group?

A Yes, users can exist alone with direct permissions

B Only if the user is an admin

C No, every user must be in a group

D Only if the user is temporary

IAM users can have permissions assigned directly without being in any group.

If a user belongs to two groups with different permissions, what happens?

A User loses all permissions

B User gets permissions from only one group

C User gets combined permissions from both groups

D User must choose which group to use

Permissions from all groups a user belongs to are combined to form the user's effective permissions.

What is NOT a feature of IAM users?

A They have credentials to access AWS

B They can belong to groups

C They can be assigned permissions directly

D They automatically have admin rights

IAM users do not automatically have admin rights; permissions must be explicitly assigned.

Why is it better to assign permissions to groups rather than individual users?

A Groups are faster to create

B Groups reduce repetitive permission assignments

C Users cannot have permissions directly

D Groups automatically secure data

Assigning permissions to groups reduces the need to assign permissions repeatedly to each user.

Explain how IAM users and groups work together to manage access in AWS.

Think about how a team shares access rights through group membership.

Describe the benefits of using IAM groups instead of assigning permissions directly to each user.

Imagine managing keys for a building by giving them to groups instead of individuals.