AWS Identity and Access Management (IAM)

What it is

AWS Identity and Access Management (IAM) controls who can sign in to AWS (authentication) and what they can do (authorization). You create identities, such as users, groups, and roles, and attach policies that allow or deny actions on resources. IAM, IAM Identity Center, and AWS STS are offered at no additional charge.

Almost every exam question about permissions involves IAM. This tutorial covers the model and the policy types. For roles, temporary credentials, the root user, and least privilegeLeast privilegeGiving each person or system only the permissions it needs for its task, and no more. In IAM, this means starting with no access and allowing specific actions on specific resources.Glossary entryClose in depth, see IAM roles and temporary credentials.

Identities

• Root user: created with the account, with full access. Protect it with MFAMFA (Multi-factor authentication)Signing in with two or more different kinds of proof, such as a password plus a code from a phone app or a security key. AWS recommends MFA for the root user and for every human user.Glossary entryClose, and don't use it for daily work.
• IAM users: long-term credentials (a password and access keys) for a person or application. AWS recommends federation and temporary credentials for people, and roles for workloads, instead of IAM users where possible.
• User groups: collections of users that share permissions. Groups can't be nested, and a user can belong to several groups.
• Roles: identities with permissions but no long-term credentials. Users, AWS services, applications, and federated usersIdentity federationLetting people sign in to AWS with an identity from another provider, such as a company directory, instead of creating IAM users for them. They receive temporary credentials through an IAM role.Glossary entryClose assume them to get temporary credentials from AWS STS.
  • Instance profiles pass a role to EC2 instances.
  • IAM Roles Anywhere gives temporary credentials to workloads outside AWS using X.509 certificates.

Policy types

AWS supports nine policy types:

1. Identity-based policies: attached to users, groups, or roles; managed (reusable, AWS managed or customer managed) or inline (embedded in one identity).
2. Resource-based policiesResource-based policyA permissions policy attached to a resource, such as an S3 bucket policy or an SQS queue policy, that says which principals can use it, including principals in other accounts. Identity-based policies, in contrast, attach to users, groups, and roles.Glossary entryClose: attached to resources such as S3 buckets, SQS queues, and KMS keys. They name a PrincipalPrincipalA person or workload that can make requests to AWS, such as an IAM user, a role session, the root user, a federated user, or an AWS service. Resource-based policies name the principals they allow.Glossary entryClose, which enables cross-account access.
3. Permissions boundaries: a managed policy that sets the maximum permissions an identity-based policy can grant to a user or role, for example when delegating role creation to developers.
4. Service control policies (SCPsSCP (Service control policy)An AWS Organizations policy that sets the maximum permissions for IAM users and roles in member accounts. It grants nothing by itself, and it does not apply to the management account.Glossary entryClose): maximum permissions for principals in AWS Organizations member accounts.
5. Resource control policies (RCPsRCP (Resource control policy)An AWS Organizations policy that sets the maximum permissions on resources in member accounts, such as S3 buckets and KMS keys, whoever requests access. Like an SCP, it grants nothing by itself.Glossary entryClose): maximum permissions for resources in member accounts.
6. Session policies: passed when assuming a role, to limit that session.
7. VPC endpointVPC endpointA private connection from a VPC to an AWS service or another endpoint service without crossing the internet. Gateway endpoints, for Amazon S3 and DynamoDB, are route table targets; interface endpoints are network interfaces that use AWS PrivateLink.Glossary entryClose policies.
8. Access control listsACL (Access control list)A list attached to a resource that names who may access it and what they may do. VPC subnets have network ACLs; Amazon S3 buckets also support ACLs, but new buckets disable them in favor of policies.Glossary entryClose (ACLs), a legacy mechanism for services such as S3.
9. AWS RAM resource shares.

A JSONJSON (JavaScript Object Notation)A text format for structured data made of name-and-value pairs and lists, such as {"bucket": "logs"}. IAM policies, most AWS API responses, and many CloudFormation templates are written in JSON.Glossary entryClose policy statement has:

• Effect: Allow or Deny.
• Action: such as s3:GetObject.
• Resource: ARNsARN (Amazon Resource Name)The unique identifier of an AWS resource, in the form arn:partition:service:region:account-id:resource. IAM policies use ARNs to name the resources they allow or deny.Glossary entryClose.
• Condition (optional): such as aws:SourceIp, aws:MultiFactorAuthPresent, or aws:PrincipalTag.
• Principal: in resource-based policies.

How a request is evaluated

1. By default, every request is implicitly denied (except for the root user).
2. An explicit Deny in any applicable policy always wins.
3. Otherwise, the request needs an Allow, and must also fit within any SCPs, RCPs, permissions boundaries, and session policies that apply.
4. Cross-account: the request is allowed only if both accounts allow it. The calling principal's identity policy must allow the action, and the resource's policy (or a role the caller assumes) must allow the other account.

Tools to get to least privilege

• IAM Access Analyzer:
  • Finds resources shared with external entities.
  • Finds internal access to critical resources.
  • Finds unused access (roles, keys, and permissions).
  • Validates policies against best practices, and generates policies from CloudTrail activity.
• Last accessed information shows which services a user or role actually used, so you can remove unused permissions.
• Credential reports list every user and the status of their passwords, access keys, and MFA.
• Attribute-based access controlABAC (Attribute-based access control)An access control approach that grants permissions by matching attributes, such as tags on a user or role and on a resource, instead of listing each resource. In AWS, ABAC uses tags in IAM policy conditions, so new resources with the right tags are covered without editing the policy.Glossary entryClose (ABAC) grants permissions based on tags on principals and resources, so policies scale without listing every resource.

Security, resilience, performance, and cost

Security

• Require MFA, especially for the root user and privileged users.
• Use federation (IAM Identity Center or SAMLSAML (Security Assertion Markup Language)An XML-based standard for passing sign-in information from an identity provider, such as Microsoft Entra ID or Okta, to a service. AWS accepts SAML 2.0 for single sign-on, directly in IAM or through IAM Identity Center.Glossary entryClose/OIDCOIDC (OpenID Connect)A sign-in standard built on OAuth 2.0 that lets an application learn who a user is from a trusted identity provider, through a signed ID token. IAM accepts OIDC providers, so that, for example, a GitHub Actions workflow can assume an IAM role.Glossary entryClose providers) for people, and roles for workloads.
• Rotate or remove long-term access keys, and grant least privilege.

Resilience

• IAM replicates data across data centers worldwide for high availabilityHA (High availability)The ability of a system to keep serving users when parts of it fail, usually by running redundant copies across Availability Zones and failing over automatically. It is often stated as a percentage of uptime, such as 99.99%.Glossary entryClose. It is eventually consistentEventual consistencyA read may briefly return older data after a write, but all copies catch up shortly afterwards. DynamoDB reads are eventually consistent by default and cost half as much as strongly consistent reads.Glossary entryClose: changes take time to become visible everywhere, so don't put IAM changes in the critical path of your application.

Cost

• No charge for IAM, IAM Identity Center, or STS. IAM Access Analyzer external access analysis is free; unused access analysis and custom policy checks are charged.

IAM or another option?

If the requirement is	Choose
Give an EC2 instance or Lambda function permissions	IAM role (instance profile or execution role)
Single sign-onSSO (Single sign-on)Signing in once to reach many applications or accounts without signing in to each again. AWS IAM Identity Center provides single sign-on to AWS accounts and applications.Glossary entryClose for employees to many accounts	IAM Identity Center
Sign-up and sign-in for app customers	Amazon Cognito
Limit what any principal in member accounts can do	SCPs in AWS Organizations
Let developers create roles without escalating privileges	Permissions boundaries
Find resources shared outside the account	IAM Access Analyzer

Reverse mindmap: when the question points here

• Identities
  • Permissions for EC2 or Lambda→ leads to IAM role
  • Many users with the same permissions→ leads to User group
  • Servers outside AWS need AWS credentials→ leads to IAM Roles Anywhere
  • Access from another account→ leads to Cross-account role
• Policies
  • Bucket shared with another account→ leads to Resource-based policy
  • Cap what a delegated admin can grant→ leads to Permissions boundary
  • Allow only with MFA→ leads to Condition aws:MultiFactorAuthPresent
  • Allow by matching tags→ leads to ABAC with aws:PrincipalTag
• Evaluation
  • Allow and deny both present→ leads to Explicit deny wins
  • No policy mentions the action→ leads to Implicit deny
  • Cross-account call fails→ leads to Both sides must allow
• Least privilege
  • Find external sharing→ leads to IAM Access Analyzer
  • Remove unused permissions→ leads to Last accessed information
  • Audit credentials of all users→ leads to Credential report

Key takeaways

• IAM authenticates and authorizes requests with users, groups, and roles, and is free.
• Prefer federation and roles with temporary credentials over IAM users with long-term keys; groups can't be nested.
• Requests are implicitly denied by default; an explicit deny always wins; SCPs, RCPs, boundaries, and session policies cap permissions.
• Cross-account access needs both the caller's policy and the resource's policy (or role trust) to allow it.
• IAM Access Analyzer, last accessed data, and credential reports help reach least privilege; ABAC scales permissions with tags.

Sources

• IAM User Guide: What is IAM?
• IAM User Guide: Security best practices in IAM
• IAM User Guide: IAM user groups
• IAM User Guide: IAM roles
• IAM User Guide: Use instance profiles
• IAM Roles Anywhere User Guide: What is IAM Roles Anywhere?
• IAM User Guide: Policies and permissions
• IAM User Guide: Managed policies and inline policies
• IAM User Guide: IAM JSON policy element reference
• IAM User Guide: Permissions boundaries for IAM entities
• IAM User Guide: Policy evaluation logic
• IAM User Guide: How AWS enforcement code logic evaluates requests
• IAM User Guide: Cross-account policy evaluation logic
• IAM User Guide: Identity providers and federation
• IAM User Guide: Troubleshoot IAM (eventual consistency)
• IAM User Guide: Using IAM Access Analyzer
• IAM User Guide: Refine permissions using last accessed information
• IAM User Guide: Generate credential reports
• IAM User Guide: Define permissions based on attributes with ABAC