IAM User

An IAM User is an AWS identity with long-term credentials - a username/password for console access and/or access keys for programmatic access.

When to Use (and Not Use)

• Human Access: use IAM Identity Center instead of IAM users; it provides SSO, MFA, temporary credentials, and centralized management
• Application Access: use IAM Roles instead; EC2 instance profiles, Lambda execution roles, ECS task roles all provide temporary credentials
• Cross-Account: use role assumption instead of sharing IAM user credentials
• Third-party SaaS: use IAM roles with external ID instead of sharing access keys

If You Must Use IAM Users

• Enforce MFA on all users (hardware or virtual)
• Set a password policy (length, complexity, rotation)
• Rotate access keys every 90 days (use Credential Report to audit)
• Never share credentials between people
• Use IAM Access Analyzer to identify unused users and permissions