Certopolis

AWS Certified Cloud Practitioner

AWS root user vs IAM users, groups and roles explained

The root user is the identity created with the account; it has complete access and should be kept for the few tasks that require it. An IAM user is one person or workload with long-term credentials, a user group applies the same permissions to many users, and an IAM role is assumed by whoever needs it and gives temporary credentials.

The root user

When you create an AWS account you start with one sign-in identity that has complete access to all AWS services and resources in the account. It signs in with the email address and password used to create the account.

AWS strongly recommends that you do not use the root user for everyday tasks. Use it only for tasks that require root user credentials. For daily work AWS recommends an administrative user in AWS IAM Identity Center.

In a standalone account (not in AWS Organizations), examples of root-only tasks are changing the account email address, root user password or root access keys, closing the account, restoring IAM permissions if the only IAM administrator revokes their own, activating IAM access to the Billing and Cost Management console, signing up for AWS GovCloud (US), registering as a seller in the Reserved Instance Marketplace, and enabling MFA delete on an S3 bucket. Changing the account name or contact information does not need the root user.

IAM users and user groups

An IAM user is an identity you create in your account. It represents a person or workload and consists of a name and credentials, such as a console password or access keys. These are long-term credentials. A new IAM user has no permissions until you grant them.

AWS recommends that human users sign in through federation with an identity provider and use temporary credentials, and that IAM users be kept for cases federation does not support, such as emergency access or third-party tools that cannot use IAM Identity Center.

An IAM user group is a collection of IAM users. Attach a policy to the group and every user in it gets those permissions. A user can be in several groups, groups cannot contain other groups, and a group cannot be named as a principal in a policy because it is not something that signs in.

IAM roles

An IAM role has permissions like a user, but it is not tied to one person. It is intended to be assumable by anyone who needs it. It has no long-term password or access keys. Assuming it gives temporary security credentials for that session.

Roles can be assumed by IAM users in the same or another account, by AWS services such as Amazon EC2 or AWS Lambda acting for you, and by users signed in through an external identity provider. Typical uses are giving an application on EC2 access to AWS without storing keys in it, giving another account access to your resources, and letting an outside auditor review your resources.

Where the exam catches people

  • Believing an IAM user with administrator permissions is the same as the root user: AWS says they are different identities, and some tasks still need root user credentials.
  • Believing the root user should be used for daily administration: AWS recommends using it only for root-only tasks and using an administrative user in IAM Identity Center otherwise.
  • Believing a role has a password or access keys: a role has no long-term credentials and gives temporary credentials when assumed.
  • Believing a user group can be nested or named as a principal: groups hold only users, and a group cannot be a principal in a policy.
  • Believing every account setting needs the root user: in a standalone account the account name and contact information can be changed without it.

Written from Amazon Web Services's documentation

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

  1. Which of the following tasks require the root user of a standalone AWS account? (Select TWO.)

    Right. In the game that’s Renown for your Security and Compliance building.

    Not that one: A,D is right. In the game your Security and Compliance building would lose a little Renown, and this question would come back later.

    Written from docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html

  2. Which of the following AWS identities has long-term credentials such as a password or access keys?

    Right. In the game that’s Renown for your Security and Compliance building.

    Not that one: B is right. In the game your Security and Compliance building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    AWS recommends federation with temporary credentials for human users instead, and IAM users only for use cases federation does not support.

    Written from docs.aws.amazon.com/IAM/latest/UserGuide/id_users.html

  3. Which of the following AWS identities is intended to be assumable by anyone who needs it?

    Right. In the game that’s Renown for your Security and Compliance building.

    Not that one: C is right. In the game your Security and Compliance building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    It has no long-term credentials; assuming it provides temporary security credentials for the role session.

    Written from docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html