Identity and Access Management (IAM)

AWS Identity and Access Management (IAM) is a service that helps you securely control access to AWS resources. IAM is global — it is not tied to a specific region — and it is available at no additional charge.

---

Why IAM Matters

By default, when you create an AWS account, you have a single root user with unlimited access. This is dangerous for day-to-day operations. IAM lets you:

• Create individual users with specific permissions
• Organise users into groups
• Define policies that specify what actions are allowed or denied
• Use roles to grant temporary permissions to services or users

---

Core IAM Components

Users

An IAM user represents a person or application that interacts with AWS. Each user has:

• A unique name within the account
• Credentials (password for console access, access keys for programmatic access)
• Permissions defined by attached policies

Best practice: Create individual IAM users instead of sharing credentials.

Groups

A group is a collection of IAM users. You attach policies to groups, and all users in the group inherit those permissions.

Example:

Group	Policy	Users
Developers	Full EC2 + S3 access	Alice, Bob
ReadOnly	Read-only access to all services	Charlie
Admins	Full access	David

Policies

Policies are JSON documents that define permissions. They specify:

• Effect — Allow or Deny
• Action — What API calls are permitted (e.g., s3:GetObject)
• Resource — Which resources the action applies to (e.g., a specific S3 bucket)

Example policy — allow read-only S3 access:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::my-bucket",
        "arn:aws:s3:::my-bucket/*"
      ]
    }
  ]
}

Roles

An IAM role is an identity with permissions that can be assumed by users, applications, or AWS services. Roles do not have permanent credentials — they provide temporary security credentials.

Common use cases:

• An EC2 instance that needs to read from S3
• A Lambda function that needs to write to DynamoDB
• A user from another AWS account that needs temporary access

---

The Principle of Least Privilege

The most important IAM best practice: grant only the permissions required to perform a task — nothing more.

This means: