An IAM User Group is a collection of IAM user accounts. IAM User Groups simplify permission management by allowing you to grant, change, and revoke permissions for multiple IAM user accounts at once. For example, you could create an IAM User Group named "Administrators" and grant administrative permissions to that group. Any IAM user account within the group automatically inherits the permissions assigned to the group.
Step 1: Create an IAM User Group
To create a new IAM User Group:
- Click on "Groups" in the left menu.
- Click "Create a group."
- Provide a group name and an optional description.
- Attach relevant IAM policies to the group to define the group's permissions.
- Review the settings and click "Create group."
Step 2: Assign Permissions to an IAM User Group
You can attach policies to a group during the creation of a new IAM User Group or to an existing IAM User Group. To attach policies to an existing group:
- Log in as the Root User or a User Account with appropriate permissions. You will need to provide your username/email and password.
- Search for the IAM User Group by entering its name in the search bar and selecting the correct IAM User Group from the search results.
- By default, you will see the "Permissions" tab on the IAM User Group details page.
- Click the "Attach Policies" button, and a window will appear containing all policies.
- Search for the policies you want to attach by entering the exact name of the policies in the search bar.
- Select the policies you want to attach from the search results and click the "Attach" button in the lower right corner of the popup.
- Your IAM User Group will now have all the permissions contained in the attached policies, and all IAM user accounts in the group will inherit these permissions.
Step 3: Assign IAM User Accounts to an IAM User Group
You can assign IAM user accounts to an IAM User Group during the creation of a new IAM User Group or to an existing IAM User Group. To assign IAM user accounts to an existing IAM User Group:
- Log in as the Root User or a User Account with appropriate permissions. You will need to provide your username/email and password.
- Search for the IAM User Group by entering its name in the search bar and selecting the correct IAM User Group from the search results.
- Click on the "Users" tab on the IAM User Group details page.
- Click the "Add user" button, and a window will appear containing all your IAM user accounts.
- Select the IAM user accounts and click the "Add" button in the lower right corner of the popup.
- Your IAM user accounts will now inherit all the permissions of the group.
Step 4: Deleting an IAM User Group
You can delete an IAM User Group using two options:
Delete multiple IAM User Groups at once:
- Access the IAM Console with the Root account or an IAM User Account with appropriate permissions.
- Click on "Groups" in the left menu.
- Select the IAM User Groups you want to delete (a "Delete" button will be enabled in the upper right corner when you select at least one group).
- Click the "Delete" button, a confirmation window will appear to ensure you are not deleting the wrong group, then click the "Confirm" button to complete the process.
Delete a single IAM User Group: We recommend accessing the details of the IAM User Group and then deleting it to ensure you are not deleting the wrong group.
Remember that once you confirm the deletion of an IAM User Group, it cannot be recovered.Please review and assign new policies to the IAM User Accounts that belonged to the deleted IAM User Groups to ensure that the IAM User Accounts still function correctly.