Users, Groups, and Roles
~14 min read
The three identity types in IAM and when to use each one.
An IAM User represents a permanent identity — a specific person or application — with long-term credentials: a username/password for Console access and/or an access key pair for programmatic (CLI/SDK) access. Because these credentials are long-lived, they carry ongoing risk if leaked, and AWS recommends rotating access keys regularly and enabling MFA on every user.
An IAM Group is simply a named collection of IAM Users, used purely for organizing permission management — you attach policies to the group, and every user in that group inherits those permissions. Groups cannot be nested (no groups-within-groups), and a user can belong to multiple groups, inheriting the union of all their permissions.
An IAM Role is fundamentally different from a User: it has no permanent credentials at all. Instead, an identity (a person, an application, or an AWS service like EC2 or Lambda) 'assumes' the role temporarily and receives short-lived, automatically-expiring credentials (typically valid for 15 minutes to a few hours) via the AWS Security Token Service (STS). This is the recommended way to grant AWS resources permissions to call other AWS services — an EC2 instance or Lambda function is given a Role, and the AWS SDK running on that resource automatically fetches and refreshes temporary credentials with no code needed to manage them.
In the AWS Console
- 1
IAM → Roles → Create role
Choose the trusted entity type (AWS service, another AWS account, or a web identity for federated login), then attach the permission policy.
The 'trusted entity' defines who/what is allowed to assume this role — this is the key concept that differs from a User, which anyone with its credentials can use.
💬 Deep Dive with AI
Key points
- •IAM User = permanent identity, long-lived credentials, for a person or standalone app
- •IAM Group = collection of users sharing the same attached policies, for easier management
- •IAM Role = temporary identity, no permanent credentials, assumed as needed — the correct choice for AWS resources calling AWS services
- •Groups can't be nested; users can belong to multiple groups