Which AWS Service Lets You Grant Permissions to Users as a Group?
A company wants to organize its users so that the company can grant permissions to the users as a group. Which AWS service or tool can the company use to meet this requirement?
Community Insight
The question tests identification of IAM as the AWS access management service, and the usual trap is choosing "Security groups" because of the word "group."
AWS Identity and Access Management (IAM) is the service that lets a company organize users into IAM groups and attach permissions to the group rather than to each user individually. This page confirms why option B is the answer and why the similarly named Security groups and Resource groups do not apply.
Many learners pick "Security groups" simply because it contains the word group, but an EC2 security group is a virtual firewall for network traffic, not a container for user permissions.
Community Discussion (2 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
AWS Identity and Access Management (IAM) is exactly the service built for this scenario: it manages users, and it provides IAM groups, which are collections of IAM users that share one set of permissions. The company creates a group, attaches an IAM policy to the group, and every user added to that group inherits the permissions, so access is administered once at the group level instead of user by user. As Kaushal1987 explains, "all users in that group inherit those permissions. This makes it easier to manage access for multiple users." ShaiTay summarises the same point in one line: IAM "allows you to manage users and their permissions." That is the definition of centralised identity and access management, and it is the only option in the list that deals with identities at all.
Why the Other Options Are Wrong
A. Security groups are stateful virtual firewalls that control inbound and outbound traffic for EC2 instances and other elastic network interfaces; they filter packets by port, protocol and source, and cannot hold users or grant identity permissions. C. Resource groups use tags to collect AWS resources such as instances, buckets and databases into a view for operations and automation; a resource group never contains users. D. AWS Security Hub is a security posture and findings aggregation service that runs compliance checks and consolidates alerts; it is a detection tool, not a directory, and creates no user groups. Only IAM has users, groups, roles and policies as its core primitives.
Community Comment Notes
Both commenters converge on IAM, and the reasoning offered matches the AWS documentation rather than a guess. Kaushal1987's point about IAM groups being "collections of users" that inherit permissions is the precise mechanism the question is asking about, and it is worth memorising as a one-sentence definition. ShaiTay's shorter description of IAM as the tool to manage "users and their permissions" reinforces that the deciding keyword in the question is users, not group. Neither commenter defends Security groups or Resource groups, which confirms the distractor set is easy to eliminate once you know what each service actually does.
Key Takeaway
Map the noun in the question to the right service category: users and permissions → IAM, network traffic → security groups, tagged resources → resource groups, security findings → Security Hub.
Official Reference
Exam Strategy
When a CLF-C02 question mentions users, identities, groups, roles or permissions, IAM is almost always the answer, so scan the options for it first and then verify the others are unrelated services. Do not be swayed by wording overlap such as "Security groups" — read what each option actually manages.
Frequently Asked Questions
Why can't the company use Security groups to organize users?
Security groups are virtual firewalls that filter traffic to EC2 resources. They contain network rules, not users, so they cannot grant identity permissions.
What is the difference between an IAM group and a resource group?
An IAM group is a collection of IAM users that share permissions. A resource group is a tag-based collection of AWS resources such as EC2 instances for management and automation.
Related Analysis
Practice All CLF-C02 Questions
Access 120 questions with complete answers and detailed explanations.
View Full CLF-C02 Practice Test →