AWS Root User vs IAM

Imagine you just moved into a brand new apartment building. The landlord hands you one master key it opens every door. Every room. Every storage unit. Every floor. Your room, your neighbor’s room, the electricity vault, the rooftop everything.

Would you carry that key to the grocery store? Hand it to a friend? Leave it on your desk?

Of course not. You’d lock it away and only touch it in a real emergency.

That master key is your AWS Root User. And IAM is the smarter, safer system you build on top of it.

When you first create an AWS account, Amazon gives you one login one email, one password. This is your Root User. It is the god-mode account of your entire AWS universe.

IAM stands for Identity and Access Management. It is a free AWS service that lets you create separate identities inside your account each with their own controlled permissions.

Instead of one master key for everything, IAM lets you create dozens of specific keys. A developer gets access to the server room only. A data analyst gets access to the data bucket only. No one gets the billing room unless they absolutely need it.

A policy is a simple JSON document. It answers three questions: Who? What action? On which resource? Here is a real example granting read-only access to an S3 bucket:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect":   "Allow",
      "Action":   [
                  "s3:GetObject",
                  "s3:ListBucket"
                ],
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}