AWS Identity and Access Management (IAM) - Complete Guide
Why AWS IAM is Important
AWS Identity and Access Management (IAM) is the cornerstone of security in AWS. It controls who can access your AWS resources and what they can do with them. Every action in AWS requires authentication and authorization through IAM, making it essential for protecting your cloud infrastructure from unauthorized access and potential security breaches.
What is AWS IAM?
AWS IAM is a free service that enables you to manage access to AWS services and resources securely. With IAM, you can create and manage AWS users, groups, and roles, and use permissions to allow or deny their access to AWS resources.
Key Components of IAM:
1. Users
Individual accounts for people or applications that need to interact with AWS. Each user has unique credentials (username/password for console access, access keys for programmatic access).
2. Groups
Collections of users that share the same permissions. For example, you might have a Developers group or an Administrators group. Users can belong to multiple groups.
3. Roles
Identities with specific permissions that can be assumed by users, applications, or AWS services. Roles are temporary and do not have permanent credentials. They are ideal for granting cross-account access or allowing EC2 instances to access other AWS services.
4. Policies
JSON documents that define permissions. Policies specify what actions are allowed or denied on which resources. They can be attached to users, groups, or roles.
How AWS IAM Works
Authentication: Verifies who you are (using credentials like passwords, access keys, or MFA tokens).
Authorization: Determines what you can do based on the policies attached to your identity.
The Principle of Least Privilege: IAM follows the security best practice of granting only the minimum permissions necessary to perform a task.
Policy Evaluation Logic:
- By default, all requests are denied (implicit deny)
- An explicit allow in a policy overrides the default deny
- An explicit deny in any policy overrides any allows
Types of IAM Policies:
Identity-based policies: Attached to users, groups, or roles
Resource-based policies: Attached to resources like S3 buckets
AWS managed policies: Pre-built policies created and maintained by AWS
Customer managed policies: Custom policies you create and manage
Inline policies: Policies embedded in a single user, group, or role
IAM Security Features:
- Multi-Factor Authentication (MFA): Adds an extra layer of security requiring a code from a device in addition to a password
- Password Policies: Enforce complexity requirements and rotation
- Access Keys: For programmatic access via CLI or SDK
- IAM Credentials Report: Lists all users and their credential status
- IAM Access Analyzer: Identifies resources shared with external entities
Exam Tips: Answering Questions on AWS Identity and Access Management (IAM)
1. Remember the Root User: The root user has complete access to all AWS services. Best practice is to lock away root user credentials, enable MFA, and use IAM users for daily tasks.
2. Groups Cannot Be Nested: Groups can only contain users, not other groups. Users can belong to multiple groups.
3. Roles vs Users: When a question mentions EC2 instances or Lambda functions needing access to other AWS services, the answer is typically IAM Roles, not users or access keys stored on the instance.
4. Policy Deny Takes Precedence: If a question involves conflicting permissions, remember that an explicit deny always wins over an allow.
5. IAM is Global: IAM is not region-specific. Users, groups, roles, and policies are available across all regions.
6. IAM is Free: There is no charge for using IAM. You only pay for other AWS resources your users access.
7. Federation: Questions about corporate users accessing AWS typically involve IAM Identity Center (successor to AWS SSO) or federation with external identity providers.
8. Shared Responsibility: AWS secures the IAM infrastructure, but you are responsible for managing users, credentials, and policies.
9. Credential Reports: For questions about auditing user credentials or checking password age, the answer is the IAM Credentials Report.
10. Common Exam Scenarios:
- Temporary access = IAM Roles
- Cross-account access = IAM Roles with trust policies
- Programmatic access = Access Keys
- Console access = Username and Password with optional MFA
- Centralized identity management = IAM Identity Center