AWS Solutions Architect · Lesson

IAM Users and Groups

Create IAM users, organise them into groups, and assign group-level permissions to simplify access management.

IAM Users and Groups is a free AWS Solutions Architect lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the AWS Solutions Architect learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

What Is AWS IAM?

AWS IAM controls who can sign in and what they're allowed to do. It's free and built on three pieces: users, groups, and roles. 🔐

IAM Users: Individual Identities

An IAM user is one person or app. It can have a console password to log in by hand, plus access keys for code. Best practice: always turn on MFA.

# Create a new IAM user
aws iam create-user --user-name alice

# Create console access (requires setting login profile)
aws iam create-login-profile \
  --user-name alice \
  --password 'Temp@1234!' \
  --password-reset-required

IAM Groups: Organising Users

An IAM group bundles users together. Attach a policy once, and everyone in the group gets those permissions — no editing each user one by one.

# Create a group and attach a managed policy
aws iam create-group --group-name Developers
aws iam attach-group-policy \
  --group-name Developers \
  --policy-arn arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess

# Add a user to the group
aws iam add-user-to-group \
  --user-name alice \
  --group-name Developers

IAM Groups: Rules and Limits

A few group rules to remember: a user can join up to 10 groups, groups can't be nested, and they're not real identities — they just bundle permissions.

The Root User: Handle With Care

The root user is the email you signed up with and has unlimited power. Lock it away: turn on MFA, delete its keys, and never use it day to day.

Access Keys: Programmatic Access

Access keys are an ID and secret that let code call AWS. Never put them in your source code, rotate them often, and delete ones you don't use.

# Generate access keys for a user
aws iam create-access-key --user-name alice

# List access keys and see their age
aws iam list-access-keys --user-name alice

IAM Permissions Evaluation

IAM is deny by default: nothing is allowed unless a policy says so. A user with no policies attached can do absolutely nothing.

Managed Policies vs Inline Policies

A managed policy can be reused across many identities, while an inline policy is glued to just one. Prefer managed ones so you don't repeat yourself.

Viewing IAM Users and Groups in the Console

In the console, IAM → Users and Groups show who's who, their permissions, and MFA status. The credential report gives you a full audit in one CSV.

# Generate and download the IAM credential report
aws iam generate-credential-report
aws iam get-credential-report \
  --query 'Content' \
  --output text | base64 --decode

Service Control Policies in AWS Organisations

With AWS Organizations, Service Control Policies (SCPs) set guardrails across accounts. They never grant access — they only cap what anyone can do, even root.

Federating Identities with SSO

Instead of one IAM user per employee, big teams use identity federation: people log in with their company account (Okta, Azure AD) and get temporary AWS access.

Quick Check

Test your understanding of AWS Solutions Architect (SAA-C03) concepts from this lesson.

Lesson Recap

Quick recap: users are individual identities, groups bundle their permissions, and the root user stays locked away with MFA. Next up: roles and policies.

Frequently asked questions

Is the “IAM Users and Groups” lesson free?

Yes — the full text of “IAM Users and Groups” is free to read here on the web, and the AWS Solutions Architect course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the AWS Solutions Architect course, upgrade to CoddyKit PRO.

What will I learn in “IAM Users and Groups”?

Create IAM users, organise them into groups, and assign group-level permissions to simplify access management. You practise AWS Solutions Architect with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start AWS Solutions Architect?

No prior experience is required. AWS Solutions Architect on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “IAM Users and Groups” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this AWS Solutions Architect lesson?

Yes. Every AWS Solutions Architect lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to AWS Solutions Architect