AWS Identity and Access Management (IAM)

Quick Answer: AWS IAM is a free, global service that controls who (authentication) can do what (authorization) in your AWS account. Key components: Users (people), Groups (collections of users), Roles (temporary permissions for services/apps), and Policies (JSON documents defining permissions). Always follow the principle of least privilege.

IAM Overview

AWS Identity and Access Management (IAM) is one of the most important AWS services for the exam. It enables you to securely manage access to AWS services and resources.

Key Facts:

• IAM is free — there is no charge for using IAM
• IAM is global — it is not Region-specific (users, groups, roles, and policies apply across all Regions)
• IAM supports MFA (Multi-Factor Authentication) for additional security
• IAM provides centralized control of your AWS account

The Root User

When you first create an AWS account, you create a root user with the email and password used to sign up. The root user has complete, unrestricted access to everything in the account.

Root User Best Practices

Tasks That REQUIRE the Root User

• Change account settings (name, email, root password)
• Change AWS Support plan
• Close the AWS account
• Restore IAM user permissions (if the only IAM admin is locked out)
• Configure an S3 bucket for MFA delete
• View certain tax invoices

IAM Components

IAM Users

An IAM user represents a person or service that interacts with AWS. Each user has:

• A unique name within the account
• Credentials: password (for console access) and/or access keys (for CLI/API access)
• Permissions: defined by attached policies

Best Practice: Create individual IAM users for each person who needs access. Never share credentials.

IAM Groups

An IAM group is a collection of IAM users. Groups make it easier to manage permissions for multiple users.

Example Groups: Administrators, Developers, Finance, ReadOnlyUsers

IAM Roles

An IAM role is similar to a user but is intended to be assumed by anyone or anything that needs it. Roles provide temporary security credentials.

Common use cases for roles:

On the Exam: When a question asks how to grant an AWS service (like EC2 or Lambda) permission to access another service (like S3 or DynamoDB), the answer is almost always an IAM role.

IAM Policies

IAM policies are JSON documents that define permissions. They specify what actions are allowed or denied on which resources.

Policy structure:

• Version — Policy language version (always "2012-10-17")
• Statement — One or more individual permission statements
  • Effect — "Allow" or "Deny"
  • Action — The API action(s) being permitted or denied (e.g., s3:GetObject)
  • Resource — The AWS resource(s) the action applies to (ARN)
  • Condition (optional) — Conditions for when the policy applies

Policy Types:

The Principle of Least Privilege

Least privilege means granting only the minimum permissions necessary for a user, group, or role to perform their required tasks. This is a fundamental security principle in AWS.

Example: If a developer only needs to read objects from a specific S3 bucket, their policy should only allow s3:GetObject on that specific bucket — NOT s3:* on all buckets.

Multi-Factor Authentication (MFA)

MFA adds an extra layer of security by requiring:

1. Something you know — Password
2. Something you have — MFA device (virtual or hardware)

MFA options in AWS:

On the Exam: Always enable MFA on the root account. MFA is a best practice for all IAM users with console access, especially administrators.

IAM Best Practices Summary

1. Lock away the root user — Enable MFA, do not use for daily tasks
2. Create individual IAM users — One user per person, never share
3. Use groups to assign permissions — Easier to manage than individual user policies
4. Use roles for AWS services — Never embed access keys in code
5. Grant least privilege — Start with minimum permissions, add as needed
6. Enable MFA everywhere — Especially for privileged accounts
7. Rotate credentials regularly — Change passwords and access keys
8. Use IAM Access Analyzer — Identify resources shared with external entities
9. Use AWS Organizations — Manage multiple accounts with service control policies