Creating users

Before we introduce this recipe, we need to talk briefly about Identity and Access Management (IAM). It's free and is enabled on every account. It allows you to create groups and users and allows you to control exactly what they can and can't do using policy assignment.

By default, groups and users will have no permissions until you assign them either an AWS Managed Policy or a Customer Managed Policy (one which you manage). You'll want to use AWS Managed Policies as much as possible to avoid having to create and maintain your own.

Note

There's a third kind of policy called an Inline Policy. Use this sparingly. In fact, the only time we typically see it is in CloudFormation templates.

You pretty much never want to assign a policy directly to a user. If you go down this path, you'll create a lot of work for yourself in the future. Instead, you want to apply policies to groups and then assign users to those groups. Fortunately, it's a pretty easy process and we're about to walk...