aws-iaas-user-roles.html.md.erb

---
title: AWS Permissions Guidelines
owner: Program Management
---

<%= vars.company_name %> recommends that you minimize the use of master account credentials by creating an IAM role and instance profile with the minimum required EC2, VPC, and EBS credentials.

Additionally, <%= vars.company_name %> recommends that you follow AWS account security best  practices such as disabling root keys, using multi-factor authentication on the  root account, and using CloudTrail for auditing API actions.

For more Amazon-specific best practices, see the following topics in the AWS documentation:

* [IAM Roles Best Practices](http://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html)

* [AWS Security Best Practices Whitepaper](http://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf)

* [AWS Well-Architected Framework](https://d0.awsstatic.com/whitepapers/architecture/AWS_Well-Architected_Framework.pdf)