AWS IAM in plain English: lock your account before it costs you
IAM (Identity and Access Management) controls access to your AWS account. The essentials: never use the root account for daily work, enable MFA, create individual users and roles, and grant least privilege, only the permissions each one truly needs. These free habits prevent the most common and costly AWS disasters.
The most expensive AWS mistakes beginners make are not about choosing the wrong service, they are about access. An access key accidentally pushed to a public code repository can be found by bots within minutes and used to run up thousands of dollars in charges. IAM is how you prevent that, and the basics are simple.
Root vs users: never work as root
When you create an AWS account, you get a root user with unlimited power over everything, including billing and account closure. You should almost never use it. Lock it with MFA, store its credentials safely, and create separate IAM users for actual work.
The root account is like the master key to a building. You keep it in a safe and use normal keys day to day. If a normal key is lost, you revoke it; if the master key leaks, you have a catastrophe.
Users, groups, and roles
An IAM user is a person or application with its own credentials. A group bundles users so you assign permissions once (for example, a Developers group). A role is a set of permissions that can be temporarily assumed, often by AWS services or applications, without permanent credentials.
Roles are the secure modern pattern: instead of storing a key inside an application, you give the application a role, and AWS hands it short-lived credentials automatically.
Least privilege: the golden rule
Grant each user, group, or role only the permissions it genuinely needs, and nothing more. A person who only reads reports does not need permission to delete databases. This is called least privilege, and it limits the damage any single compromised identity can do.
Start restrictive and add permissions when a real task requires them. It is far safer than starting with full access and trying to remove it later.
Protect credentials like cash
Never hard-code access keys in your code or commit them to a repository. Use roles where possible, and a secrets manager for anything that must be stored. Rotate keys periodically, and delete keys that are no longer used.
If a key ever leaks, deactivate it immediately, do not wait. AWS and security tools can scan public repositories for exposed keys, but the fastest protection is never putting them there.
A five-minute hardening checklist
Enable MFA on the root user and on every IAM user. Create an admin IAM user for yourself instead of using root. Put users in groups and attach permissions to groups. Remove any permissions nobody uses. Turn on CloudTrail so every action is logged.
None of this costs money, and together it prevents the overwhelming majority of real AWS security incidents. Do it before you build anything important.
Key takeaways
- Never use the root account for daily work, lock it with MFA and create IAM users instead.
- Use groups to manage permissions at scale and roles to give applications access without stored keys.
- Apply least privilege: grant only the permissions each identity truly needs, and add more only when required.
- Never hard-code or commit access keys; rotate them, and deactivate any leaked key immediately.
Frequently asked questions
A user has permanent credentials and usually represents a person. A role has no permanent credentials, it is temporarily assumed, typically by an AWS service or application, which receives short-lived credentials automatically. Roles are more secure because there is no long-lived key to leak.
Bots scan public code repositories constantly, so a leaked key can be abused within minutes, often to mine cryptocurrency, running up a large bill. Deactivate the key immediately in IAM, delete it, and review your account activity in CloudTrail. Prevention, never committing keys, is far better.
Yes. MFA is the single most effective protection against account takeover, and it is free. Even a small account with a payment method attached is a target. Enabling MFA takes a few minutes and stops the most common attacks outright.
Sources
- Amazon Web Services, 2026. "AWS IAM best practices."
- Amazon Web Services, 2026. "What is IAM?."
- Amazon Web Services, 2026. "Security best practices in IAM."
Want your AWS account secured properly from the start? Kaevor sets up safe, well-structured cloud accounts for African teams. Message us on WhatsApp, we respond same day.
Chat on WhatsApp →