Lesson 04 — IAM Groups

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 02 – Identity & Access Management (IAM)

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand the purpose of IAM Groups.
Create and manage IAM Groups.
Add and remove users from Groups.
Apply permissions using Groups instead of individual users.
Implement Role-Based Access Control (RBAC).
Manage enterprise access efficiently.

📚 Lesson Information

Estimated Time: 3 Hours

Difficulty: Beginner

Prerequisites: Lesson 03 – IAM Users

Hands-on Lab: Yes

Assignment: Yes

💼 Business Value

Imagine CloudNova Technologies has:

600 Employees
80 Developers
40 Cloud Engineers
20 Security Engineers
15 Finance Users
12 Auditors

If permissions are assigned directly to every individual user:

Administration becomes difficult.
Human errors increase.
Auditing becomes complex.
Employees receive inconsistent permissions.

IAM Groups solve this problem by allowing permissions to be assigned once and inherited by every member of the group.

🏢 In the Company

CloudNova Technologies has grown rapidly.

Currently every employee has permissions assigned directly to their IAM User.

The CISO identifies several problems:

Difficult to manage
Inconsistent permissions
Users with excessive access
Time-consuming onboarding

Your task is to redesign access using IAM Groups.

🌍 What is an IAM Group?

An IAM Group is a collection of IAM Users.

Permissions are assigned to the Group rather than individual users.

Every user in the Group automatically inherits those permissions.

🏗 Why Use Groups?

Without Groups

Developer 1
     │
     ├── EC2 Access
     ├── S3 Access
     └── CloudWatch Access

Developer 2
     │
     ├── EC2 Access
     ├── S3 Access
     └── CloudWatch Access

Developer 3
     │
     ├── EC2 Access
     ├── S3 Access
     └── CloudWatch Access

Permissions must be managed separately.

With Groups

Developers Group
        │
        ├── EC2 Access
        ├── S3 Access
        └── CloudWatch Access
                │
      ┌─────────┼─────────┐
      ▼         ▼         ▼
 Alice      John      David

One change updates permissions for every developer.

🔐 Benefits of IAM Groups

Easier administration
Consistent permissions
Simplified onboarding
Simplified offboarding
Easier auditing
Supports Least Privilege
Reduces human error

📋 CloudNova Department Structure

For this course, CloudNova uses the following Groups.

Group	Purpose
Cloud-Admins	AWS Administrators
Cloud-Engineers	Infrastructure
Developers	Application Deployment
Security-Team	Security Services
SOC-Team	Monitoring
Finance	Billing
Auditors	Read-Only Access

🛡 Role-Based Access Control (RBAC)

RBAC assigns permissions based on job roles rather than individuals.

Example:

Employee

↓

Department

↓

IAM Group

↓

Permissions

↓

AWS Resources

Instead of assigning permissions directly to Alice, assign Alice to the Developers Group.

👤 IAM Users vs IAM Groups

IAM User	IAM Group
Individual Identity	Collection of Users
Has Credentials	No Credentials
Can Sign In	Cannot Sign In
Represents One Person	Represents a Team
Receives Permissions	Shares Permissions

🏗 Enterprise Group Design

CloudNova IAM Structure

CloudNova

│

├── Cloud-Admins

├── Cloud-Engineers

├── Developers

├── Security-Team

├── SOC-Team

├── Finance

└── Auditors

Every employee belongs to one or more Groups.

🚫 Common Mistakes

❌ Assign AdministratorAccess to every user.

❌ Create one Group for every employee.

❌ Use Groups without naming standards.

❌ Leave inactive users in Groups.

❌ Assign permissions directly to users whenever possible.

✅ Best Practices

Assign permissions to Groups.
Add users to Groups.
Review Group membership regularly.
Use descriptive names.
Follow Least Privilege.
Remove users immediately when they leave.
Document Group ownership.

🧪 Enterprise Mission 01 — View Existing Groups

Open AWS Console.

Navigate:

IAM

↓

User Groups

Review:

Group Names
Number of Members
Attached Policies

Questions:

How many Groups exist?
Which departments already have Groups?

🧪 Enterprise Mission 02 — Create a Group (Console)

Navigate:

IAM

↓

User Groups

↓

Create Group

Create the following Groups:

Cloud-Admins

Cloud-Engineers

Developers

Security-Team

SOC-Team

Finance

Auditors

Do not attach policies yet.

🧪 Enterprise Mission 03 — Create Groups (AWS CLI)

Create Developers Group

aws iam create-group --group-name Developers

Create Security Group

aws iam create-group --group-name Security-Team

Create Finance Group

aws iam create-group --group-name Finance

List Groups

aws iam list-groups

🧪 Enterprise Mission 04 — Add Users to Groups

Add Alice

aws iam add-user-to-group \
--group-name Developers \
--user-name alice.dev

Add Rohit

aws iam add-user-to-group \
--group-name Cloud-Engineers \
--user-name rohit.cloud

Add John

aws iam add-user-to-group \
--group-name Security-Team \
--user-name john.security

Verify Group Members

aws iam get-group \
--group-name Developers

🧪 Enterprise Mission 05 — List User Groups

List Groups for Alice

aws iam list-groups-for-user \
--user-name alice.dev

Questions:

Which Groups is Alice a member of?
Should Alice belong to multiple Groups?

🧪 Enterprise Mission 06 — Remove User from Group

Remove Alice

aws iam remove-user-from-group \
--group-name Developers \
--user-name alice.dev

Verify

aws iam get-group \
--group-name Developers

🧪 Enterprise Mission 07 — Delete a Group

Delete Finance Group

aws iam delete-group \
--group-name Finance

Verify

aws iam list-groups

🧪 Enterprise Mission 08 — Enterprise Design Exercise

CloudNova hires the following staff:

Employee	Department
Emma	Developer
James	Security
Olivia	Cloud Engineering
Liam	Finance
Noah	SOC

Determine:

Which Group each employee joins.
Whether additional Groups are required.
Which permissions each Group should receive.

🧪 Enterprise Mission 09 — Review Group Membership

List all users.

aws iam list-users

List all Groups.

aws iam list-groups

For each user, identify:

Group Membership
Missing Group
Incorrect Group

Document your findings.

🏢 Enterprise Scenario

CloudNova Technologies acquires another company.

150 new employees join.

Departments include:

Developers
DevOps
Security
Finance
Compliance
Support

The CIO asks:

“Can we onboard everyone without assigning permissions individually?”

Design a Group-based access strategy.

📊 Knowledge Check

What is an IAM Group?
Why are Groups preferred over assigning permissions directly to users?
Can an IAM Group sign in to AWS?
Can a user belong to multiple Groups?
Which command creates a Group?
Which command lists all Groups?
Which command adds a user to a Group?
Which command removes a user from a Group?
What is RBAC?
Why should Group membership be reviewed regularly?

📝 Assignment

Prepare an Enterprise IAM Group Design Document.

Include:

IAM Group Overview
Benefits of IAM Groups
CloudNova Department Structure
RBAC Design
Group Naming Standards
AWS CLI Commands Used
Screenshots
Lessons Learned

Length:

4–5 Pages

📋 Lesson Completion Checklist

Task	Status
Reviewed Existing Groups	☐
Created Groups (Console)	☐
Created Groups (CLI)	☐
Added Users to Groups	☐
Verified Membership	☐
Removed User from Group	☐
Deleted Test Group	☐
Completed Enterprise Design	☐
Completed Assignment	☐

💡 Key Takeaways

After completing this lesson, you should understand:

IAM Groups simplify permission management by assigning permissions to teams rather than individuals.
Role-Based Access Control (RBAC) helps ensure users receive access based on their job responsibilities.
Users can belong to multiple Groups when their responsibilities span different functions.
Group membership should be reviewed regularly to maintain security and support the principle of least privilege.
Well-designed IAM Groups make onboarding, offboarding and audits significantly easier in enterprise environments.

📚 Further Reading

AWS IAM User Guide – User Groups
AWS IAM Best Practices
AWS Well-Architected Framework – Security Pillar
AWS CLI Command Reference – IAM
NIST RBAC Guidance

🚀 Next Lesson

➡️ Lesson 05 — IAM Policies