World map

 

BM

World A2: Keys & Guards

Users, groups and roles

You will learn: the three kinds of keyholders in IAM, and which one fits which job.

Checked with AWS 2026-11 on 1 Nov 2026

The problem

Five cashiers at Kedai Kancil need the same keys. A sixth joins next week. How do you hand out keys without a mess?

Watch

IAM is the mall’s key office. It knows three kinds of keyholder: users, groups and roles. Sort each one.

Drag a card into a box. Or tap the card, then tap the box.

        Watch

        bash
        aws iam create-role --role-name Test-Role --assume-role-policy-document file://Test-Role-Trust-Policy.json
        {
        "Role": {
        "AssumeRolePolicyDocument": "<URL-encoded-JSON>",
        "RoleId": "AKIAIOSFODNN7EXAMPLE",
        "CreateDate": "2013-06-07T20:43:32.821Z",
        "RoleName": "Test-Role",
        "Path": "/",
        "Arn": "arn:aws:iam::123456789012:role/Test-Role"
        }
        }

        A IAM role: A badge that trusted people or services borrow for a while. It hands out keys that expire. starts with a trust file: who may borrow this badge. The answer’s last line is its ARN (Amazon Resource Name): The full address of anything in AWS, like arn:aws:s3:::kedai-menu., the role’s full address.

        Try it

        Aina is in the Cashiers group. She opens today’s menu file. Will AWS say yes?

        Read the request and its policies. Will AWS say Allow or Deny?

        The request

        Who
        Aina (IAM user)arn:aws:iam::111122223333:user/aina
        Wants to
        s3:GetObject
        On
        arn:aws:s3:::kedai-menu/today.json
        Identity policy (key ring) · cashiers (group)
        {
        "Version": "2012-10-17",
        "Statement": [
        {
        "Effect": "Allow",
        "Action": "s3:GetObject",
        "Resource": "arn:aws:s3:::kedai-menu/*"
        }
        ]
        }
        Your guess:

        Predict

        Aina moves to the kitchen. You remove her from Cashiers. Can she still open the menu file?

        Check

        True about keyholders, or needs work? Swipe each one.

        Swipe right for good, left for needs work. Or use the buttons.

        1 / 4

        A user can be in many groups.

        You did it!

        You can now tell users, groups and roles apart, and pick the right one.

        Go deeper (optional)

        There is no built-in “everyone” group. If you want one, you make it and add every user yourself.

        Real rep: IAM itself is free. Make a group, add your admin user to it, then list it with aws iam get-group --group-name Cashiers. Delete the group when done.