102 — IAM Users and Groups

Beginner

Create an IAM user with programmatic access, build a group with a managed policy, add the user to the group, verify permissions with policy simulation, and clean up — all from the CLI.

Learning Objectives

List existing IAM users and groups with the CLI

Create an IAM user with programmatic access

Create an IAM group and attach an AWS managed policy

Add the user to the group

Verify effective permissions with aws iam simulate-principal-policy

Clean up all created resources in the correct order

Step 1

List existing IAM users

Before creating anything, inspect what IAM users already exist in your account.

Commands to Run

aws iam list-users

What This Does

aws iam list-users returns a JSON object with a UserList array.

Each element describes one IAM user: UserName, UserId (starts with AIDA), Arn, Path, and CreateDate.

For a brand-new account the array will be empty — that is expected.

Expected Outcome

JSON output like:
{
    "Users": []
}
If the account already has users, each entry shows a UserName and Arn. An empty array is normal for a new account.

Pro Tips

1
IAM operations are always free — there is no cost for any step in this lesson.
2
Add '--output table' for a more readable summary: aws iam list-users --output table

Was this step helpful?