Introduction to AWS Identity and Access Management (IAM)

SPL-66 - version 3.1.23

© 2026 Amazon Web Services, Inc. or its affiliates. All rights reserved. This work may not be reproduced or redistributed, in whole or in part, without prior written permission from Amazon Web Services, Inc. Commercial copying, lending, or selling is prohibited. All trademarks are the property of their owners.

Note: Do not include any personal, identifying, or confidential information into the lab environment. Information entered may be visible to others.

Corrections, feedback, or other questions? Contact us at AWS Training and Certification.

Lab Overview

Task 1: Explore the Users and Groups

In this task, you will explore the Users and Groups that have already been created for you in IAM.

1. At the top of the AWS Management Console, in the search bar, search for and choose IAM.
2. In the navigation pane on the left, choose Users.

   The following IAM Users have been created for you:

   • user-1
   • user-2
   • user-3
3. Choose user-1.

   This will bring to a summary page for user-1. The Permissions tab will be displayed.

4. Notice that user-1 does not have any permissions.

   Note: You should see an Unexpected error message. This is normal.

5. Choose the Groups tab.

   user-1 also is not a member of any groups.

6. Choose the Security credentials tab.

   user-1 is assigned a Console password

7. In the navigation pane on the left, choose User groups.

   The following groups have already been created for you:

   • EC2-Admin
   • EC2-Support
   • S3-Support
8. Choose the EC2-Support group.

   This will bring you to the summary page for the EC2-Support group.

9. Choose the Permissions tab.

   This group has a Managed Policy associated with it, called AmazonEC2ReadOnlyAccess. Managed Policies are pre-built policies (built either by AWS or by your administrators) that can be attached to IAM Users and Groups. When the policy is updated, the changes to the policy immediately apply against all Users and Groups to which the policy is attached.

10. Choose AmazonEC2ReadOnlyAccess under the Permissions tab and a new browser window opens. Now choose JSON.

    A policy defines what actions are allowed or denied for specific AWS resources. This policy is granting permission to List and Describe information about EC2, Elastic Load Balancing, CloudWatch and Auto Scaling. This ability to view resources, but not modify them, is ideal for assigning to a Support role.

    The basic structure of the statements in an IAM Policy is:

    • Effect says whether to Allow or Deny the permissions.
    • Action specifies the API calls that can be made against an AWS Service (eg cloudwatch:ListMetrics).
    • Resource defines the scope of entities covered by the policy rule (eg a specific Amazon S3 bucket or Amazon EC2 instance, or * which means any resource).
11. In the navigation pane on the left, choose User groups.
12. Choose the S3-Support group.

    The S3-Support group has the AmazonS3ReadOnlyAccess policy attached.

13. Choose AmazonS3ReadOnlyAccess under the Permissions tab and a new browser window opens. Now choose JSON.

    This policy has permissions to Get and List resources in Amazon S3.

14. In the navigation pane on the left, choose User groups.
15. Choose the EC2-Admin group.

    This Group is slightly different from the other two. Instead of a Managed Policy, it has an Inline Policy, which is a policy assigned to just one User or Group. Inline Policies are typically used to apply permissions for one-off situations.

16. Choose EC2-Admin-Policy under the Permissions tab. Now choose JSON tab.

    This policy grants permission to view (Describe) information about Amazon EC2 and also the ability to Start and Stop instances.

17. At the bottom of the screen, choose Cancel and then choose Continue to close the policy.

Business Scenario

For the remainder of this lab, you will work with these Users and Groups to enable permissions supporting the following business scenario:

Your company is growing its use of Amazon Web Services, and is using many Amazon EC2 instances and a great deal of Amazon S3 storage. You wish to give access to new staff depending upon their job function:

Task 2: Add Users to Groups

You have recently hired user-1 into a role where they will provide support for Amazon S3. You will add them to the S3-Support group so that they inherit the necessary permissions via the attached AmazonS3ReadOnlyAccess policy.

Add user-1 to the S3-Support Group

1. In the left navigation pane, choose User groups.
2. Choose the S3-Support group.
3. Choose the Users tab.
4. In the Users tab, choose Add users.
5. In the Add users to Group window, configure the following:
   • Select user-1.
   • At the bottom of the screen, choose Add users.

   In the Users tab you will see that user-1 has been added to the group.

Add user-2 to the EC2-Support Group

You have hired user-2 into a role where they will provide support for Amazon EC2.

1. Using similar steps to the ones above, add user-2 to the EC2-Support group.

   user-2 should now be part of the EC2-Support group.

Add user-3 to the EC2-Admin Group

You have hired user-3 as your Amazon EC2 administrator, who manage your EC2 instances.

1. Using similar steps to the ones above, add user-3 to the EC2-Admin group.

   user-3 should now be part of the EC2-Admin group.

2. In the navigation pane on the left, choose User groups.

   Each Group should have a 1 in the Users column for the number of Users in each Group.

Task 3: Sign-In and Test Users

In this task, you will test the permissions of each IAM User.

1. In the navigation pane on the left, choose Dashboard.

   An IAM users Sign-in URL is displayed. It will look similar to: https://123456789012.signin.aws.amazon.com/console

   This link can be used to sign-in to the AWS Account you are currently using.

2. Copy the IAM users Sign-in URL to a text editor.
3. Open a private window.
4. Paste the IAM users sign-in link into your private window and press Enter.

   You will now sign-in as user-1, who has been hired as your Amazon S3 storage support staff.

5. Sign-in with:
   • IAM username: user-1
   • Password: Paste the value of AdministratorPassword located to the left of these instructions.
6. At the top of the AWS Management Console, in the search bar, search for and choose S3.

   Since your user is part of the S3-Support Group in IAM, they have permission to view a list of Amazon S3 buckets and the contents.

7. At the top of the AWS Management Console, in the search bar, search for and choose EC2.
8. In the left navigation pane, choose Instances.

   You cannot see any instances. This is because your user has not been assigned any permissions to use Amazon EC2.

9. Sign user-1 out of the AWS Management Console.
10. Sign-in as user-2 with the same password.
11. Navigate to EC2 and choose Instances.

    You are now able to see an Amazon EC2 instance because you have Read Only permissions. However, you will not be able to make any changes to Amazon EC2 resources.

12. In Instance state menu, choose Stop instance.

    You will receive an error stating You are not authorized to perform this operation. This demonstrates that the policy only allows you to view information, without making changes.

13. Navigate to S3.

    You will receive an Error Access Denied because user-2 does not have permission to use Amazon S3.

14. Sign user-2 out and sign-in as user-3.
15. Navigate to EC2 and choose Instances.

    As an EC2 Administrator, you should now have permissions to Stop the Amazon EC2 instance.

16. In Instance state menu, choose Stop instance and confirm.

    The instance will enter the stopping state and will shutdown.

Conclusion

Congratulations! You now have successfully:

• Explored pre-created IAM users and groups
• Inspected IAM policies as applied to the pre-created groups
• Followed a real-world scenario, adding users to groups with specific capabilities enabled
• Located and used the IAM sign-in URL
• Experimented with the effects of policies on service access

Additional Resources

For more information about AWS IAM, see the AWS IAM documentation.

For more information about AWS Training and Certification, see https://aws.amazon.com/training/.