Root User, IAM Users and Groups
When Inkwell opened its AWS account, it used an email address and a password. That login can do absolutely anything, including closing the account. Now two developers and an accountant need access. Handing all three that one login would be like giving every employee the master key and the company chequebook.
The rule
Lock the root away; give people groups, and give groups permissions.
The root user is the identity created with the account. It has complete access, and you cannot limit it by attaching IAM policies to it. Treat it like a safe-deposit key:
- Turn on MFA (multi-factor authentication) immediately.
- Create no access keys for it.
- Use it only for the handful of tasks that need it, such as closing the account.
IAM users are identities for individual people or applications inside the account. Each has its own credentials: a password for the console and optional access keys for the CLI and SDKs. Every action is logged under their name.
IAM groups are collections of users. You attach permissions to the group, and every member receives them:
- A user can belong to several groups (up to ten).
- Groups contain users only; a group cannot contain another group.
- A group is not an identity: nobody signs in as a group.
Group: developers → EC2 and inkwell-covers bucket access
Priya, Kabir
Group: billing → read-only billing access
MeeraFor human sign-in, AWS now recommends IAM Identity Center, which gives people short-lived credentials and works across many accounts. It uses the same idea: people belong to groups, and groups carry permissions. Plain IAM users remain useful for small setups and for learning.
The shortcut
When a permission is requested, ask "Is this about the person, or the job?" It is almost always the job, so it goes on the group. The person simply joins or leaves groups.
Old job
Kabir is in
developers, so he can manage servers.
The trap is attaching policies directly to individual users. It works at first, but after a year nobody knows why Priya can delete databases, and every job change becomes detective work.
Drills
Answer fast — trust the rule.
What should Inkwell do with the root user first?
Can an IAM group contain another IAM group?
Five developers need the same new permission. What is the cleanest change?
Which statement about the root user is true?
Remember
- Lock the root away with MFA; give people groups, and give groups permissions.
- Ask "the person or the job?"; it is the job, so it goes on a group.
- Trap: policies attached to individuals turn every job change into detective work.