title: “IAM Groups” created: 2026-07-22 updated: 2026-07-22 type: knowledge tags:
- aws
- iam
- security
- certification
IAM Groups
What It Is
An IAM Group is a collection of IAM users. Groups let you specify permissions for multiple users at once, making it easier to manage permissions for sets of users who share the same job function.
Why It Matters
Groups are the recommended mechanism for assigning permissions to users at scale. Instead of attaching policies to individual users (error-prone and hard to audit), you attach policies to groups and then add users to the appropriate groups. When a policy is updated, all group members immediately get the updated permissions.
Key Concepts
How Permission Inheritance Works
IAM Policy ──attached to──► IAM Group ──membership──► IAM User
When a user is added to a group, they inherit all policies attached to that group. A user can be in multiple groups and receives the union of all permissions.
Common Group Patterns
| Group Name | Typical Policy | Use Case |
|---|---|---|
| S3-Support | AmazonS3ReadOnlyAccess | Read-only S3 support staff |
| EC2-Support | AmazonEC2ReadOnlyAccess | Read-only EC2 support staff |
| EC2-Admin | Custom inline policy (Start/Stop/Describe) | EC2 administrators |
| Admins | AdministratorAccess | Full account administrators |
Group Characteristics
- Groups cannot be nested (no group within a group)
- A group is not an identity — you cannot sign in as a group
- A user can belong to multiple groups (up to 10 by default)
- Groups can have both managed and inline policies attached
Gotchas
- There is no “default group” that all new users automatically belong to — you must explicitly add users
- Groups cannot be referenced as a Principal in a resource-based policy (e.g., S3 bucket policy)
- Removing a user from a group immediately revokes the inherited permissions
- Maximum of 300 groups per account (soft limit, can be increased)
See Also
- [[iam-users]]
- [[iam-managed-vs-inline-policies]]
- [[iam-policy-structure]]
- [[iam-instance-profiles]]