Definitions

Definition 1 AWS

A security group in AWS. It contains AWS IAM Users and may be granted permissions via policies. It has a flat structure, i.e. AWS IAM does not support group nesting.

Related Terms

• ARN

• AWS

• AWS Account

• AWS IAM

• AWS IAM User (Dictionary Entry)

• Group

Quotes

IAM Groups

An IAM group is a collection of IAM users. Groups let you specify permissions for multiple users, which can make it easier to manage the permissions for those users. For example, you could have a group called Admins and give that group the types of permissions that administrators typically need. Any user in that group automatically has the permissions that are assigned to the group. If a new user joins your organization and needs administrator privileges, you can assign the appropriate permissions by adding the user to that group. Similarly, if a person changes jobs in your organization, instead of editing that user's permissions, you can remove him or her from the old groups and add him or her to the appropriate new groups.

Note that a group is not truly an "identity" in IAM because it cannot be identified as a Principal in a permission policy. It is simply a way to attach policies to multiple users at one time.

Following are some important characteristics of groups:

- A group can contain many users, and a user can belong to multiple groups.

- Groups can't be nested; they can contain only users, not other groups.

- There's no default group that automatically includes all users in the AWS account. If you want to have a group like that, you need to create it and assign each new user to it.

- The number and size of IAM resources in an AWS account are limited. For more information, see IAM and STS quotas.

Bibliography

• AWS, 11/2020

See Also