Which option is considered a best practice for configuring long-term access in AWS IAM?

Attaching IAM policies to IAM groups and assigning users to those groups is a recognized best practice for configuring long-term access in AWS Identity and Access Management (IAM). This approach streamlines permission management and enhances security by allowing for easier policy updates and consistency in permissions across users.

When policies are attached to groups instead of individual users, it simplifies the process of managing permissions. For instance, if a new user joins the team, they can simply be added to the relevant group(s) which automatically grants them the permissions defined in those groups. This reduces the risk of errors that can occur when managing permissions on a per-user basis, as changes made to a group policy will propagate to all users within that group.

Additionally, grouping users based on their roles or responsibilities aligns with the principle of least privilege. This means that users only receive the minimum necessary permissions they need to perform their job functions, thereby limiting potential security vulnerabilities. In summary, using IAM groups not only enhances manageability and organization but also importantly supports security best practices within AWS environments.