IAM access keys question

Question

I know that an access key gives programmatic access to your AWS account and that an access key of a root account gives full access, but is the access key for a created user limited by the permissions that the user has? I understand it's best to create a user with only the permissions needed, and then create an access key for that user. Is that why?

This may sound like a basic question but I can't find a confirmation of this. I'm hoping someone can confirm this.

Accepted Answer

Yes, if you authenticate with the IAM User's access keys, the polices enforce for that user will be evaluated for authorization. You can see the full evaluation logic here: [Policy evaluation logic](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html).

IAM access keys question

Relevant content