O-Cyrus
← All guides
Guide

AWS IAM Setup for Small Business: A Practical Guide

Learn how to set up AWS IAM for your small business with this step-by-step guide. Secure your cloud resources without the complexity.

If you're running a small business and using Amazon Web Services, getting your Identity and Access Management (IAM) setup right is one of the most important things you can do. It's not glamorous, but it's the difference between a secure cloud environment and a potential disaster.

This guide walks you through setting up AWS IAM in a way that makes sense for small businesses—no overcomplicated enterprise frameworks, just practical security.

Why IAM Matters for Small Businesses

Think of IAM as the lock-and-key system for your AWS account. Without it properly configured, you're essentially leaving your front door wide open. Every person on your team would have full access to everything—your databases, your customer data, your billing information.

For small businesses, the stakes are high. You don't have a dedicated security team to clean up messes, and you can't afford downtime or data breaches. Setting up IAM correctly from the start saves you headaches later.

Before You Start

You'll need:

  • Access to your AWS root account (the email and password you used to create your AWS account)
  • A list of team members who need AWS access
  • A basic understanding of what each person needs to do in AWS

One critical rule: after this setup, you should rarely (if ever) use your root account for daily work. That account has unlimited power, and you want to protect it.

Step 1: Secure Your Root Account

First things first—lock down that root account.

  1. Log into AWS with your root account credentials
  2. Go to the IAM dashboard (search for "IAM" in the AWS console)
  3. Click on "Add MFA" (Multi-Factor Authentication) for your root account
  4. Follow the prompts to set up an authenticator app like Google Authenticator or Authy

This means even if someone gets your root password, they can't access your account without that second factor. Store your root account credentials in a password manager, and share access with only one or two trusted people.

Step 2: Create Your First Admin User

Now you'll create a user account for yourself that you'll actually use day-to-day.

  1. In the IAM dashboard, click "Users" in the left sidebar
  2. Click "Add users"
  3. Enter a username (like "john-admin" or your email)
  4. Check "Provide user access to the AWS Management Console"
  5. Choose "I want to create an IAM user" (not Identity Center for now—that's overkill for most small businesses)
  6. Create a custom password or let AWS generate one
  7. Uncheck "Users must create a new password at next sign-in" if you're setting this up for yourself

On the permissions page:

  1. Select "Attach policies directly"
  2. Search for and select "AdministratorAccess"
  3. Click through to create the user

Save the sign-in URL, username, and password somewhere safe. Then log out of your root account and log in with this new admin user. Set up MFA for this account too.

Step 3: Create Groups for Different Roles

Groups make your life easier. Instead of assigning permissions to each person individually, you assign them to groups. When someone joins or changes roles, you just add them to the right group.

For a typical small business, you might create:

Developers Group:

  1. Go to "User groups" in IAM
  2. Click "Create group"
  3. Name it "Developers"
  4. Attach policies like:
    • AmazonEC2FullAccess (if they manage servers)
    • AmazonS3FullAccess (for file storage)
    • AWSLambdaFullAccess (for serverless functions)
    • CloudWatchLogsReadOnlyAccess (to view logs)

Finance/Admin Group:

  1. Create another group called "Finance"
  2. Attach policies like:
    • Billing (for viewing costs)
    • IAMReadOnlyAccess (to see who has access)

Read-Only Group:

  1. Create a "ReadOnly" group
  2. Attach "ReadOnlyAccess" policy
  3. Good for contractors or people who just need to view things

Don't go overboard creating groups. Start with 2-3 and add more only when you have a clear need.

Step 4: Add Your Team Members

Now add actual users:

  1. Click "Users" then "Add users"
  2. Enter their name or email
  3. Enable console access if they need to log into AWS
  4. On the permissions page, select "Add user to group"
  5. Check the appropriate group(s)
  6. Create the user

Send each person their login credentials securely (not via email—use a password manager's sharing feature or a secure messaging app). Make sure they set up MFA on their first login.

Step 5: Set Up a Password Policy

This forces everyone to use decent passwords:

  1. In IAM, click "Account settings" in the left sidebar
  2. Click "Edit" under Password policy
  3. Set requirements:
    • Minimum length: 12 characters
    • Require at least one uppercase letter
    • Require at least one lowercase letter
    • Require at least one number
    • Require at least one non-alphanumeric character
    • Enable password expiration (90 days is reasonable)
  4. Save changes

Step 6: Enable CloudTrail

CloudTrail logs every action taken in your AWS account. If something goes wrong, you'll want this.

  1. Search for "CloudTrail" in the AWS console
  2. Click "Create trail"
  3. Give it a name like "company-audit-trail"
  4. Create a new S3 bucket to store logs (accept the default name)
  5. Leave other settings as default
  6. Create the trail

This costs a few dollars per month but is worth every penny for security purposes.

Common Mistakes to Avoid

Using the root account for daily work: Just don't. Create an admin user and use that instead.

Giving everyone admin access: It's tempting when you're small and moving fast, but it's a bad habit. Give people only what they need.

Sharing credentials: Each person should have their own user account. No sharing passwords, even temporarily.

Forgetting about old accounts: When someone leaves, disable their IAM user immediately. Set a calendar reminder to review all users quarterly.

Not using MFA: This is the easiest security win. Require it for everyone.

Maintaining Your IAM Setup

IAM isn't a set-it-and-forget-it thing. Every quarter:

  • Review all users and remove any that are no longer needed
  • Check that people are in the right groups
  • Review any custom policies you've created
  • Look at CloudTrail logs for anything suspicious

The IAM dashboard has a security recommendations section that will flag issues like users without MFA or unused credentials. Check it monthly.

When to Get Help

If your team is growing beyond 10-15 people, or if you're handling sensitive customer data, it might be time to bring in expertise. A proper cloud security audit can catch issues before they become problems.

Need Help With Your AWS Setup?

Setting up IAM correctly is crucial, but it's just one piece of your cloud infrastructure. If you're feeling overwhelmed or want someone to review your setup, get in touch with our team. We help small businesses get their AWS environments secure and running smoothly.

FAQ

How much does IAM cost?

IAM itself is completely free. You only pay for the AWS resources your users access. CloudTrail (which you should enable) costs around $2-5 per month for most small businesses.

Should I use AWS Organizations for my small business?

Probably not yet. AWS Organizations is designed for managing multiple AWS accounts, which most small businesses don't need. Stick with a single account and IAM groups until you have a clear reason to add complexity.

What's the difference between IAM roles and users?

Users are for people. Roles are for applications and services. For example, if you have an application running on EC2 that needs to access S3, you'd create a role for that. Don't worry too much about roles when you're starting out—focus on getting users and groups right first.

Related services

Need a hand with this?

O-Cyrus helps small businesses with websites, DNS, custom apps, and the everyday tech that keeps things running.

Talk to us →