AWS IAM: Users, Groups & Roles

IAM (Identity and Access Management) controls who can do what in AWS. The core entities are: Users (people/apps), Groups (collections of users), Roles (assumed by services or users), and Policies (permission documents).

Users & Groups

# Create user
aws iam create-user --user-name alice

# Create access keys (for programmatic access)
aws iam create-access-key --user-name alice
# Returns: AccessKeyId + SecretAccessKey (save SecretAccessKey — shown only once!)

# Create login profile (console password)
aws iam create-login-profile   --user-name alice   --password "TempPass123!"   --password-reset-required

# Create group and add user
aws iam create-group --group-name Developers
aws iam add-user-to-group --user-name alice --group-name Developers

# Attach policy to group
aws iam attach-group-policy   --group-name Developers   --policy-arn arn:aws:iam::aws:policy/PowerUserAccess

# List users/groups
aws iam list-users
aws iam list-groups
aws iam list-groups-for-user --user-name alice
aws iam list-attached-group-policies --group-name Developers

# Enable MFA for user
aws iam create-virtual-mfa-device   --virtual-mfa-device-name alice-mfa   --outfile QRCode.png   --bootstrap-method QRCodePNG
# Scan QR code, then:
aws iam enable-mfa-device   --user-name alice   --serial-number arn:aws:iam::123456789012:mfa/alice-mfa   --authentication-code1 123456   --authentication-code2 654321

Roles

Roles are assumed temporarily and provide credentials automatically. Use roles instead of long-lived access keys wherever possible.

# Create role (EC2 service can assume this role)
aws iam create-role   --role-name EC2-S3-ReadRole   --assume-role-policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Principal": {"Service": "ec2.amazonaws.com"},
      "Action": "sts:AssumeRole"
    }]
  }'

# Attach policy to role
aws iam attach-role-policy   --role-name EC2-S3-ReadRole   --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

# Create instance profile and add role (needed for EC2)
aws iam create-instance-profile --instance-profile-name EC2-S3-ReadProfile
aws iam add-role-to-instance-profile   --instance-profile-name EC2-S3-ReadProfile   --role-name EC2-S3-ReadRole

# Attach instance profile to EC2 instance
aws ec2 associate-iam-instance-profile   --instance-id i-1234567890abcdef0   --iam-instance-profile Name=EC2-S3-ReadProfile

# Cross-account role (trust another account to assume)
# Trust policy for cross-account:
# {
#   "Principal": {"AWS": "arn:aws:iam::ACCOUNT_B:root"},
#   "Action": "sts:AssumeRole",
#   "Effect": "Allow"
# }

# Assume a role (get temporary credentials)
aws sts assume-role   --role-arn arn:aws:iam::123456789012:role/EC2-S3-ReadRole   --role-session-name my-session
# Returns: AccessKeyId, SecretAccessKey, SessionToken (valid 1 hour)