AWS Identity and Access Management (IAM)
- What it is
- Controls who (authentication) can do what (authorization) on which AWS resources.
- Global service, free, and the foundation of the Security pillar.
- The core objects
- Root user — created with the account, has unrestricted power. Enable MFA, delete its access keys, and never use it for daily work.
- IAM user — a long-lived identity for a person or application. Has a password and/or access keys.
- IAM group — a collection of users. Attach policies to the group, not to each user. Groups cannot be nested and cannot be a principal.
- IAM role — a set of permissions with no long-term credentials, assumed temporarily. The preferred mechanism for EC2 instances, Lambda functions, cross-account access, and federated users.
- Policy — a JSON document (Effect, Action, Resource, Condition) granting or denying permissions.
- Evaluation rules to remember
- Everything is implicitly denied by default.
- An explicit deny always wins over any allow.
- Least privilege — grant only the permissions actually needed.
- Tasks only the root user can perform
- Change the account name, email, or root password; close the account; change the support plan; restore an IAM user’s deleted permissions; register as a seller in AWS Marketplace; enable MFA delete on an S3 bucket.
- Related but different
- AWS IAM Identity Center — workforce SSO across many accounts; the modern replacement for per-account IAM users.
- Amazon Cognito — identity for your application’s end customers.
- AWS Organizations Service Control Policies — set the permission ceiling for an account; they never grant.