IAM users, roles, and policies

15 min · Module 2

Users are long-lived identities; prefer roles for EC2/Lambda/apps (temporary credentials). Policies grant or deny actions on resources. Follow least privilege; use MFA for humans; avoid root for daily work.

Example / notes

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["s3:GetObject"],
    "Resource": "arn:aws:s3:::example-bucket/app/*"
  }]
}

Practice in Lab: /lab/

← Shared responsibility model

Modules in this track

2. Accounts, IAM & shared responsibility
- Shared responsibility model
- IAM users, roles, and policies
3. VPC & Well-Architected basics
- VPC, subnets, and gateways
- Well-Architected Framework