Unlocking AWS IAM: Understanding Users and Roles

Analogy: School Play

• IAM User → Students
  An IAM user is like a student in the school play. They are real people with a permanent identity.

• IAM Role → Costume
  An IAM role is like a costume that a student (or another identity) can put on. When they put it on, they “assume” that role and temporarily take on its powers.

Policies Explained

• IAM User has a Permission Policy
  This tells what the student (user) is allowed to do in the school.

• IAM Role has two policies:

  • Permission Policy: What the student can do once they wear the costume.

  • Trust Policy: Who is allowed to wear that costume in the first place.

---

In Simple Words

• Trust Policy = Who can wear the costume

• Permission Policy = What they can do while wearing it

IAM Users don’t need a trust policy because they are already “real” trusted identities in AWS. Roles, however, need it, since you want to control who is allowed to step into that costume.

I regularly post about cloud, networks, AI & security. Follow Farooq Butt to stay updated on recent developments.