Practice Questions

Identity and Access Management

IAM Users

An IAM user is a permanent identity representing a person or application. It has a fixed set of long-term credentials: a password for console access and/or access keys (Access Key ID + Secret Access Key) for programmatic access.

• Credentials do not expire unless you rotate or deactivate them manually
• Best practice: do not use IAM users for applications or services — use roles instead
• The root account user is a special IAM identity created when the account is opened; it has unrestricted access to everything and should never be used for daily tasks
• Enable MFA on every IAM user, and especially on the root account
• IAM Access Advisor shows the last time a user accessed each service — useful for removing unused permissions

IAM Groups

An IAM group is a collection of IAM users. Policies attached to a group apply to all users in it.

• Groups cannot be nested (a group cannot contain another group)
• A user can belong to multiple groups — permissions from all groups are combined
• Groups have no credentials of their own — they exist purely to simplify permission management
• Use groups to assign permissions by job function (e.g., Developers, Admins, ReadOnly)

IAM Roles

An IAM role is an identity with a permission policy that can be assumed by trusted entities. Unlike users, roles do not have permanent credentials. When assumed, AWS STS (Security Token Service) issues temporary credentials that expire automatically.

Roles vs. Users

Key role concepts: