AWS IAM Basics: Users, Groups, Roles & Policies

AWS Identity and Access Management (IAM) is the foundation of security on AWS. If you are studying for the CLF-C02 exam, IAM concepts appear throughout Domain 2: Security and Compliance, which carries a 30% weighting — the second-heaviest domain on the entire exam. Understanding IAM is not optional; it is essential.

This guide walks you through every IAM concept you need for exam day: what IAM is, how its four core components work together, and the key best practices that Amazon Web Services expects every practitioner to know.

What Is AWS IAM?

AWS IAM is a global service that controls who can do what in your AWS account. "Who" is the identity side — users, groups, and roles. "What" is the permission side — policies. Together they enforce the principle of least privilege: every identity should have only the permissions it needs to do its job, and nothing more.

IAM is free to use. There is no extra charge for creating users, groups, roles, or policies inside your account.

Because IAM is a global service, it is not tied to a specific AWS Region. Any user, role, or policy you create is available across every Region automatically.

The Four Core IAM Components

1. IAM Users

An IAM user represents a single person or application that needs to interact with AWS. When you create a user, AWS generates a set of long-term credentials — a username and password for the AWS Management Console, and optionally an access key ID and secret access key for programmatic access (CLI, SDKs, APIs).

Key exam points: - A brand-new IAM user has no permissions by default. You must explicitly grant permissions through a policy. - Long-term credentials (access keys) carry risk. Best practice is to rotate them regularly and avoid embedding them in application code. - IAM users are distinct from the AWS root account. The root account is created when you first open an AWS account and has unrestricted access to everything. Best practice is to lock the root account away immediately, enable Multi-Factor Authentication (MFA) on it, and use IAM users for all day-to-day work.

2. IAM Groups

An IAM group is a collection of IAM users. Instead of attaching permissions to each user individually, you attach a policy to a group and add users to that group. Every member of the group inherits those permissions automatically.

Key exam points: - Groups make permission management scalable. If a developer needs a new permission, you update the group policy once rather than editing every individual user. - Groups cannot contain other groups — they can only contain users. - A user can belong to multiple groups, and their effective permissions are the union of all policies attached to those groups (and directly to the user, if any). - Groups are not identities in the same sense as users or roles — you cannot log in as a group.

3. IAM Roles

An IAM role is an identity that can be assumed by a trusted entity — an AWS service, another AWS account, a web identity (such as a user authenticated through Amazon Cognito), or a federated identity. Unlike an IAM user, a role does not have long-term credentials. Instead, it issues temporary security credentials each time it is assumed.

Key exam points: - Roles are the preferred way to grant AWS services access to other AWS services. For example, you attach a role to an EC2 instance so it can read from an S3 bucket — no access keys stored on the server. - Roles are the right tool for cross-account access: give an external AWS account permission to assume a role in your account, and you avoid sharing credentials entirely. - The entity assuming the role must be listed in the role's trust policy (who can assume it), and its permissions come from the role's permission policies (what it can do). - Temporary credentials expire automatically, making roles inherently more secure than long-lived access keys.

4. IAM Policies

A policy is a JSON document that defines permissions. It lists which Actions (API calls) are allowed or denied on which Resources, under what Conditions.

There are two main policy types you need to know for CLF-C02:

Key exam points: - An explicit Deny always overrides any Allow. If a policy denies an action and another allows it, the deny wins. - Policies are evaluated at request time. AWS checks all applicable policies and either allows or denies the request. - The AWS managed policies (pre-built by AWS) are a convenient starting point, but custom policies let you enforce least privilege more precisely. - You attach policies; you don't assign individual permissions one by one. A policy can grant or restrict many actions at once.

The Principle of Least Privilege

The principle of least privilege is not just a buzzword — it is the core philosophy behind IAM design, and the CLF-C02 exam tests whether you understand it. The rule is simple: grant only the permissions required to perform a task, and no more.

In practice this means: - Start with no permissions and add only what is needed. - Prefer group-level policies over user-level policies. - Regularly audit and remove permissions that are no longer used. - Use roles with temporary credentials instead of long-lived access keys wherever possible.

MFA: A Non-Negotiable Best Practice

Multi-Factor Authentication (MFA) adds a second layer of verification beyond a username and password. For the CLF-C02 exam, know that:

• MFA is strongly recommended for the root account — this is considered the single most important security step after creating an AWS account.
• MFA should also be enabled for any IAM user with console access, especially those with elevated privileges.
• AWS supports multiple MFA device types, including virtual authenticator apps, hardware tokens, and passkeys.

Enabling MFA is a shared responsibility concept in action: AWS provides the MFA infrastructure, but you (the customer) are responsible for enabling it on your accounts.

IAM and the Shared Responsibility Model

IAM sits squarely on the customer's side of the shared responsibility model. AWS is responsible for the security of the cloud — the physical hardware, the global network, and the hypervisor layer. You are responsible for security in the cloud — and that means configuring IAM correctly.

If you leave an IAM user with overly broad permissions and that account is compromised, that is a customer responsibility failure, not an AWS one. This distinction appears repeatedly on the CLF-C02 exam, so make sure you understand it clearly. You can review additional security topics in our exam guide to see how IAM connects to services like CloudTrail, GuardDuty, and Inspector.

Quick Comparison: Users vs. Groups vs. Roles

How IAM Appears on the CLF-C02 Exam

IAM questions on the CLF-C02 tend to fall into a few patterns:

1. Scenario-based permission questions — "A company needs its EC2 instances to access S3 securely. What is the best practice?" (Answer: use an IAM role attached to the instance.)
2. Best practice questions — "Which action best secures the AWS root account?" (Answer: enable MFA and avoid using root for daily tasks.)
3. Shared responsibility questions — "Who is responsible for configuring IAM policies?" (Answer: the customer.)
4. Definitional questions — distinguishing between users, groups, roles, and policies.

If you want to test your current knowledge right now, our diagnostic quiz can show you exactly which Domain 2 concepts need the most attention before exam day.

For structured practice with IAM-specific scenarios, head to our practice questions — they mirror the multiple-choice and multiple-response format used in the real CLF-C02 exam.

FAQ

What is the difference between an IAM user and an IAM role?

An IAM user is a permanent identity with long-term credentials (password and/or access keys) assigned to a specific person or application. An IAM role is a temporary identity that any trusted entity — such as an AWS service, another account, or a federated user — can assume. Roles issue short-lived credentials that expire automatically, making them more secure for programmatic access and cross-account scenarios.

Can an IAM group contain other groups?

No. IAM groups can only contain IAM users, not other groups. If you need to layer permissions, use multiple group memberships for a user or attach additional policies directly to the user.

Why should I use roles for EC2 instances instead of access keys?

Embedding access keys in an EC2 instance (or in application code) creates a long-term credential that can be leaked, stolen, or forgotten. An IAM role attached to an instance automatically provides and rotates temporary credentials, so your application never needs to store a static secret. This follows the principle of least privilege and reduces the blast radius if the instance is ever compromised.

What does "least privilege" mean in practice?

Least privilege means granting an identity only the permissions it absolutely needs to do its specific job — no more. In IAM terms, that means starting with no permissions and adding only what is required, rather than starting with broad access and trying to remove things later. AWS managed policies are a useful starting point, but a carefully written custom policy is almost always more precise.

Is enabling MFA on the root account mandatory?

AWS strongly recommends it and considers it the most critical security step for any new account, but it is a best practice rather than a hard technical requirement that blocks access. The CLF-C02 exam treats root account MFA as a definitive best practice, so always choose "enable MFA on root" when it appears as an option in a security scenario question.

What happens when there is a conflict between an Allow and a Deny in IAM policies?

An explicit Deny always wins. If any policy attached to an identity explicitly denies an action, that action is blocked regardless of how many other policies grant an Allow for the same action. The only exception is for AWS Organizations service control policies, which operate at an account level — but understanding that level of detail is beyond what CLF-C02 requires.

Wrapping Up

IAM is the cornerstone of AWS security, and it is well-represented on the CLF-C02 exam. Focus on understanding the purpose of each component — users for individuals, groups for collections of users, roles for services and temporary access, and policies for defining permissions. Layer on the principle of least privilege and MFA best practices, and you will be well-prepared for every IAM question exam day throws at you.