Identity and Access Management (IAM) in AWS

Controlling Who Can Do What, When, and Where in Your AWS Environment

AWS Identity and Access Management (IAM) is the cornerstone of security and access control in AWS. It lets you define, enforce, and audit permissions for users, services, and resources across your cloud infrastructure.

What is IAM?

IAM is a global AWS service that allows you to:

• Create users, groups, and roles
• Define policies to grant or deny permissions
• Enable secure access for humans and machines
• Use MFA, password policies, and temporary credentials

🧠 IAM follows the principle of least privilege: only give what’s necessary and nothing more.

Core Components of IAM

🧍 IAM Users

• Created for individual people needing AWS access
• Can be assigned:
  • Console login
  • Programmatic access (access key/secret key)
• Should never be root user for daily operations

✅ Example:

aws iam create-user --user-name dev-user

aws iam create-user --user-name dev-user

👨‍👩‍👧‍👦 IAM Groups

• Logical way to apply the same permissions to multiple users
• Can attach policies to the group instead of each user
• Example groups: Admins, Developers, Auditors

👤 IAM Roles

Roles are temporary, assumable identities used by:

• EC2 instances
• Lambda functions
• Applications or services in other AWS accounts
• Federated identities (SSO, external IdPs)

✅ Role Assumption Examples:

• Lambda uses a role to access S3
• EC2 assumes a role to send logs to CloudWatch
• AWS CodePipeline assumes a role to deploy via ECS

🛡️ IAM Policies – Granting and Restricting Access

Policies are written in JSON and attached to users, groups, or roles.

✅ Policy Elements:

✅ Example Policy: Read-Only Access to S3

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["s3:GetObject", "s3:ListBucket"],
    "Resource": "*"
  }]
}

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["s3:GetObject", "s3:ListBucket"],
    "Resource": "*"
  }]
}

Managed vs Inline Policies

🎯 Best Practice: Use customer-managed for flexibility; avoid inline unless necessary.

Trust Policies – Defining Who Can Assume Roles

Trust policies allow another AWS service, user, or account to assume the role.

✅ Example: Allow EC2 to Assume Role

{
  "Effect": "Allow",
  "Principal": { "Service": "ec2.amazonaws.com" },
  "Action": "sts:AssumeRole"
}

{
  "Effect": "Allow",
  "Principal": { "Service": "ec2.amazonaws.com" },
  "Action": "sts:AssumeRole"
}

Multi-Factor Authentication (MFA)

• Adds an extra layer of security for IAM users
• Can use Google Authenticator, Authy, or hardware tokens
• Recommended for:
  • Root user
  • IAM admins
  • Billing access

✅ Enable MFA via Console:

IAM → Users → Security Credentials → MFA → Assign MFA Device

⚙️ IAM Access Analyzer

• Identifies public or cross-account access to resources
• Useful for audits and security reviews
• Integrated into AWS Console and CLI

✅ Sample Findings:

• S3 bucket open to public
• KMS key shared with external account
• IAM role trusted by multiple services

IAM Policy Simulator

• Test how a policy behaves without deploying it
• Check if a user can perform an action
• Avoids security risks from misconfigured policies

🧪 Try iam:SimulatePrincipalPolicy via CLI or Console.

            +----------------+
            |   IAM User     |
            +--------+-------+
                     |
             +-------v--------+
             |     Group      |
             +-------+--------+
                     |
             +-------v--------+      +---------------+
             |   Attached     |----->|  IAM Policy    |
             |   Permissions  |      +---------------+
                     |
             +-------v--------+
             |   IAM Role     |
             +-------+--------+
                     |
             +-------v--------+
             |  EC2, Lambda   |
             +----------------+

            +----------------+
            |   IAM User     |
            +--------+-------+
                     |
             +-------v--------+
             |     Group      |
             +-------+--------+
                     |
             +-------v--------+      +---------------+
             |   Attached     |----->|  IAM Policy    |
             |   Permissions  |      +---------------+
                     |
             +-------v--------+
             |   IAM Role     |
             +-------+--------+
                     |
             +-------v--------+
             |  EC2, Lambda   |
             +----------------+

IAM Best Practices

🔐 Real-World Use Cases

Summary