ECS 3.6.2 Data Access Guide

ECS IAM identities

ECS IAM provides the ability to manage IAM identities within each namespace such as users, groups, roles, and namespace root user.


ECS IAM Identities	Description
Users	An ECS IAM user represents a person or an application in the namespace that can interact with the ECS resources. ECS IAM users belong to one or more IAM groups. ECS IAM users have long-term credentials associated with them which are used to access ECS S3, IAM, and STS resources. The credential consists of an access key ID and a secret access key. ECS IAM users can access API but not the user interface.
Groups	ECS IAM Groups is a collection of ECS IAM users. Groups let you specify permissions for all the users in the group. Groups cannot contain other groups. NOTE: Groups cannot access any ECS APIs only IAM users, and roles can access it.
Roles	An ECS IAM role is an identity that is assumable by trusted internal and external users. A role does not have any credentials associated with it. Instead, when an entity assumes a role, the system provides you the temporary credentials which contain an access key ID, secret access key, and a security token.
Root user	Namespace root user is an admin user who can also access the user interface. Namespace root user is used as owner in ACLs for IAM access. Namespace root user console access can be enabled by specifying a password during namespace creation or later.

For more information about configuring these identities, see ECS Administration Guide.