AWS IAM – Identity & Access Management

1. Users and Groups

IAM = Identity and Access Management, and it is a Global service — not Region-scoped, as noted in Cloud Computing & AWS Overview.

• A root account is created by default when you open an AWS account. It shouldn’t be used or shared.
• Users are people within your organization, and they can be grouped.
• Groups only contain users, not other groups — no nesting.
• Users don’t have to belong to a group, and a user can belong to multiple groups.

Real-world example

The deck’s diagram: Alice, Bob and Charles sit in the group Developers; David and Edward sit in Operations; Charles and David are also in the group Audit Team; and Fred belongs to no group at all. Fred is still a valid IAM user — his permissions just have to be attached to him directly.

2. Permissions and policies

Users or Groups can be assigned JSON documents called policies. These policies define the permissions of the users.

In AWS you apply the least privilege principle: don’t give more permissions than a user needs.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ec2:Describe*",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "elasticloadbalancing:Describe*",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "cloudwatch:ListMetrics",
                "cloudwatch:GetMetricStatistics",
                "cloudwatch:Describe*"
            ],
            "Resource": "*"
        }
    ]
}

Policy inheritance

A policy attached to a group applies to every user in that group — so Alice, being in both Developers and Audit Team, picks up both sets. A policy attached directly to a single user is called an inline policy; that is how a user like Fred, who is in no group, gets any permissions at all.

Exam tip

Two facts the exam likes: a group cannot contain another group, and a user can be in several groups at once (accumulating all their permissions). Anything describing “nested groups” is a distractor.

3. IAM policy structure

A policy consists of:

• Version — policy language version, always include 2012-10-17.
• Id — an identifier for the policy (optional).
• Statement — one or more individual statements (required).

A statement consists of:

• Sid — an identifier for the statement (optional).
• Effect — whether the statement allows or denies access (Allow, Deny).
• Principal — account / user / role to which this policy is applied.
• Action — list of actions this policy allows or denies.
• Resource — list of resources to which the actions apply.
• Condition — conditions for when this policy is in effect (optional).

Exam tip

Know which fields are optional: Id, Sid and Condition. Version, Statement, Effect, Action and Resource are what you will see in every real policy.

4. Password policy

Strong passwords mean higher security for your account. In AWS you can set up a password policy that can:

• Set a minimum password length.
• Require specific character types: uppercase letters, lowercase letters, numbers, non-alphanumeric characters.
• Allow all IAM users to change their own passwords.
• Require users to change their password after some time (password expiration).
• Prevent password re-use.

5. Multi Factor Authentication (MFA)

Users have access to your account and can possibly change configurations or delete resources. You want to protect your root account and your IAM users.

MFA = a password you know + a security device you own.

The main benefit: if a password is stolen or hacked, the account is not compromised.

MFA device options in AWS

Device	Details
Virtual MFA device	Google Authenticator (phone only), Authy (phone only). Support for multiple tokens on a single device
Universal 2nd Factor (U2F) Security Key	YubiKey by Yubico (3rd party). Support for multiple root and IAM users using a single security key
Hardware Key Fob MFA Device	Provided by Gemalto (3rd party)
Hardware Key Fob MFA Device for AWS GovCloud (US)	Provided by SurePassID (3rd party)

Exam tip

The distinguishing feature of Authy (and virtual MFA generally) is multiple tokens on one device; the distinguishing feature of the U2F security key is multiple users on one key. And AWS GovCloud (US) is the keyword that points at SurePassID.

6. How users access AWS

There are three options:

• AWS Management Console — protected by password + MFA.
• AWS Command Line Interface (CLI) — protected by access keys.
• AWS Software Developer Kit (SDK), for code — protected by access keys.

About access keys:

• They are generated through the AWS Console.
• Users manage their own access keys.
• Access keys are secret, just like a password. Don’t share them.
• Access Key ID ≈ username; Secret Access Key ≈ password.

An example of (fake) access keys from the deck:

Access key ID:     AKIASK4E37PV4983d6C
Secret Access Key: AZPN3zojWozWCndIjhB0Unh8239a1bzbzO5fqqkZq

The AWS CLI

• A tool that lets you interact with AWS services using commands in your command-line shell.
• Gives direct access to the public APIs of AWS services.
• You can develop scripts to manage your resources.
• It is open-source: https://github.com/aws/aws-cli.
• An alternative to using the AWS Management Console.

The AWS SDK

• Language-specific APIs (a set of libraries).
• Lets you access and manage AWS services programmatically.
• Embedded within your application.
• Supports SDKs (JavaScript, Python, PHP, .NET, Ruby, Java, Go, Node.js, C++), Mobile SDKs (Android, iOS…) and IoT Device SDKs (Embedded C, Arduino…).
• The AWS CLI is itself built on the AWS SDK for Python.

Exam tip

Console → password + MFA. CLI and SDK → access keys. If a question asks how to let an application running in your own code talk to AWS, the answer is the SDK; if it is a shell script, the CLI.

7. IAM Roles for Services

Some AWS services need to perform actions on your behalf. To allow that, you assign permissions to AWS services with IAM Roles.

Common roles:

• EC2 Instance Roles
• Lambda Function Roles
• Roles for CloudFormation

Real-world example

An EC2 instance (a virtual server — see Amazon EC2) needs to read a file from storage. Rather than baking access keys into the instance, you attach an IAM Role to the instance and it accesses AWS with those permissions.

Exam tip

“How should an EC2 instance be granted permission to call an AWS API?” → an IAM role, never access keys stored on the instance.

8. IAM Security Tools

Tool	Level	What it gives you
IAM Credentials Report	Account-level	A report listing all your account’s users and the status of their various credentials
IAM Access Advisor	User-level	Shows the service permissions granted to a user and when those services were last accessed — use it to revise your policies

Exam tip

Credentials Report = account level, lists users and credentials. Access Advisor = user level, shows last-accessed times. The level is the fastest way to tell the two apart in an answer list.

9. IAM guidelines and best practices

• Don’t use the root account except for AWS account setup.
• One physical user = one AWS user.
• Assign users to groups and assign permissions to groups.
• Create a strong password policy.
• Use and enforce the use of Multi Factor Authentication (MFA).
• Create and use Roles for giving permissions to AWS services.
• Use Access Keys for programmatic access (CLI / SDK).
• Audit permissions of your account using IAM Credentials Report and IAM Access Advisor.
• Never share IAM users and access keys.

10. Shared Responsibility Model for IAM

AWS	You
Infrastructure (global network security)	Users, Groups, Roles, Policies management and monitoring
Configuration and vulnerability analysis	Enable MFA on all accounts
Compliance validation	Rotate all your keys often
	Use IAM tools to apply appropriate permissions
	Analyze access patterns and review permissions

Exam tip

Everything about who has which permission is on you. AWS is only responsible for the infrastructure IAM runs on, its configuration and vulnerability analysis, and compliance validation.

Quick recap

Concept	What to remember for the exam
IAM	Global service; root account created by default and should not be used or shared
Users	Mapped to a physical user; has a password for the AWS Console
Groups	Contain users only — no nested groups; a user may be in several groups or none
Policies	JSON documents outlining permissions for users or groups; apply least privilege
Policy fields	Version, Id (optional), Statement → Sid (optional), Effect, Principal, Action, Resource, Condition (optional)
Roles	Give permissions to AWS services — EC2 instance roles, Lambda function roles, CloudFormation
Security	MFA + password policy; MFA = password you know + device you own
MFA devices	Virtual (Google Authenticator, Authy), U2F key (YubiKey), Hardware key fob (Gemalto), GovCloud key fob (SurePassID)
Access to AWS	Console (password + MFA), CLI (access keys), SDK (access keys)
AWS CLI	Manage AWS services from the command line; open-source; built on the AWS SDK for Python
AWS SDK	Manage AWS services from a programming language, embedded in your application
Audit	IAM Credentials Report (account level) and IAM Access Advisor (user level, last accessed)