IAM Users

Users are individuals within your account who need to access and manage resources.

Each user has a unique set of security credentials. It means username and password or access keys for authentication.

IAM user in Amazon Web Service or AWS Identity and Access Management is an entity that represents an individual with unique credentials and permissions to access and interact with AWS resources.

IAM users are used to separate different individuals or entities within an account and control what actions they can perform on resources.

---

Key Components of IAM Users

Credentials

Each user has its own set of credentials used for authentication. This typically includes a username and password or we can say access key ID and secret access key.

Access Keys are often used for programmatic access, while username and password are used for console or web based access.

For example, if you’re using Java, then for that you need to use programmatic access and you need to create an access key and also secret access key. Or for example, if you’re using the console, then you can use your username and also password.

Access and Permissions

IAM users are associated with permissions that define what actions they are allowed or denied on resources.

Permissions are managed through policies which can be attached directly to the user or to groups to which the user belongs.

Principle of least privilege

IAM encourages, the principle of least privilege, meaning that IAM users should only be granted the minimum set of permissions required for their specific tasks.

This helps reduce the risk of accidental or intentional misuse of resources.

Console Access

Users can log in up to the AWS Management Console using their username and password.

They can perform actions and manage resources using the console graphical interface.

Programmatic Access

IAM users can use access keys to interact with AWS services programmatically through the command line interface, CLI, SDK or software development kits, and also other tools.

MFA & Security

IAM users can be required to use multifactor authentication or MFA to provide an additional layer of security when login logging in.

So this involves using a second form of authentication, such as a smartphone app, in addition to the regular password.

Delegation of Access

AWS account owners can create IAM users and delegate to specific responsibilities to them.

It allows different individuals or teams to manage and access resources without sharing the primary account credentials.

Lifecycle Management

IAM users can be created, updated and deleted as needed.

This provides flexibility and and managing access for temporary or transient users.

Users Policy

In addition to group policies, IAM users can also have inline policies attached directly to them. These inline policies grant additional permissions specific to that user.