What are IAM Groups in AWS?

What are IAM Groups in AWS?
  • An IAM group is a collection of IAM users.

  • It is a way to assign permissions/policies to multiple users at once.

  • Use Groups to specify permissions for a collection of users, which can make those permissions easier to manage for those users.

    e.g. You can have a group called HR and give that group the types of permissions that the HR department typically needs.

  • Any user in that group automatically has the permission that is assigned to the group.

  • If a new user joins your organization and should have HR privileges, you can assign the appropriate permissions by adding the user to that group.

  • If a person changes his job/post in your organization, instead of editing that user's permission, you can remove him or her from the old groups and add him or her to the appropriate new groups.

IAM Group Limitations

  • A group is not truly an 'identity' in IAM because it can not be identified as a principal in a permission policy.

  • Groups can't be nested i.e. you can not make groups inside a group.

  • You have a limit of 300 groups in an AWS account.

  • A user can be a member of upto 10 IAM groups.