aws_iam_group cost estimation
An IAM group is free. It bundles users so they share a set of policies. AWS charges nothing for the group. Cost comes from what the member users are permitted to do.
An aws_iam_group is a collection of IAM users that share attached permission policies, so you manage access by team or function instead of per user. IAM is a free service, so groups, their memberships, and the policies attached to them cost nothing. There is no per-group charge.
A group cannot do anything by itself; it only grants its policies to the users inside it. That means the cost implication of a group is the union of what its member users can do once they inherit its permissions. A group that attaches a broad administrator policy does not cost money, but it authorizes every member to operate services that do. The bill follows the members' actions across those services, never the group.
There is no financial optimization at the group level, only least-privilege scoping for security. Groups are useful for cost governance in an indirect way: reviewing the policies attached to a high-membership group tells you which services a whole team can drive spend on. c3x treats IAM groups as free and prices the services the members actually use.
Terraform example
A minimal but realistic configuration that C3X can estimate.
resource "aws_iam_group" "developers" {
name = "developers"
}
resource "aws_iam_group_policy_attachment" "dev_readonly" {
group = aws_iam_group.developers.name
policy_arn = "arn:aws:iam::aws:policy/ReadOnlyAccess"
}Pricing dimensions
What you actually pay for when you provision aws_iam_group.
| Dimension | Unit | What's being charged |
|---|---|---|
| IAM group | free | The group, its memberships, and attached policies have no charge. $0 |
| Services members operate | varies (billed elsewhere) | What the group's members are permitted to do is billed on the services they use. Depends on the service |
Optimization tips
Common ways to reduce aws_iam_group cost without changing the workload.
Manage permissions by group for auditability
Grouping users under shared policies makes it easier to see which teams can touch which billable services. This aids governance; the group itself is free.
Scope group policies to least privilege
A group that grants broad access widens the blast radius across every member. Tightening it is a security move, not a cost saving, since groups cost nothing.
Review high-membership groups for spend exposure
A group with many members and broad policies authorizes a lot of potential spend. Auditing its policies shows where cost could accrue across the team.
FAQ
Does an IAM group cost money?
No. IAM groups are free, including their memberships and attached policies. You pay only for the services the group's member users are permitted to operate.
Is there a limit or fee on the number of groups?
There is no fee. Groups are always free. There are account quotas on the number of groups and group memberships, but no price attached to them.
Can a group's policies raise my bill?
Only indirectly. The group is free, but the policies it attaches let member users operate billable services. The charge lands on those services based on member activity, not on the group.
Related resources
Estimate this resource in your own Terraform
Free, open source, no API key. C3X parses your Terraform and shows line-item cost for every resource, including aws_iam_group.