AWS Builder Center

Builder Center

Getting Started with AWS IAM: Permissions Done Right

IAM

If you've ever created an AWS account and just used the root user for everything — stop. Here's why IAM matters and how to set it up properly in a few minutes.

What IAM actually is

AWS Identity and Access Management (IAM) controls who can do what in your AWS account. Instead of one all-powerful root login, IAM lets you create individual users, groups, and roles — each with only the permissions they actually need.

Step 1: Stop using the root user

The root user is created when you sign up for AWS and has unrestricted access to everything, including billing. The moment you're set up:
  1. Go to IAM → Users → Add users
  2. Create yourself an admin user with a strong password and MFA enabled
  3. Log out of root, log back in as that user, and keep root credentials locked away for emergencies only

Step 2: Use groups, not individual permissions

Instead of attaching policies to each person one by one:
  1. IAM → User groups → Create group (e.g., Developers, Admins)
  2. Attach AWS-managed policies like AmazonS3ReadOnlyAccess or PowerUserAccess
  3. Add users to the group — permissions update automatically if the group's policies change

Step 3: Follow least privilege

Only grant the access someone actually needs. A few practical moves:
  • Start with AWS-managed policies, then tighten with custom JSON policies as you understand your real needs
  • Use policy conditions to restrict by IP, MFA status, or resource tags
  • Regularly run IAM Access Analyzer to spot unused or overly broad permissions
json
1
2
3
4
5
6
7
8
9
10
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::my-bucket/*"
}
]
}

Step 4: Use roles for AWS services, not access keys

If an EC2 instance, Lambda function, or app needs to talk to other AWS services, don't hardcode access keys into the code. Instead:
  1. IAM → Roles → Create role
  2. Choose the AWS service that will use it (e.g., EC2)
  3. Attach the permissions it needs
  4. Assign the role to the resource — it gets temporary, auto-rotating credentials instead of long-lived keys

One security habit worth building now

Enable MFA on every human user, especially anyone with admin access. It's the single biggest reduction in account-takeover risk for the least effort.
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article