📖 What is AWS Identity and Access Management (IAM)?
AWS Identity and Access Management (IAM) is a web service that helps you securely control access to AWS resources. It allows you to create users, groups, and roles, and use permissions policies to grant specific access to resources based on the principle of least privilege.
"Always apply the principle of least privilege; never use the root user for daily tasks and prefer IAM Roles over long-term access keys for applications."
📚 Certification: AWS Certified Solutions Architect - Associate (SAA-C03)
🔑 What are the Key Concepts of AWS Identity and Access Management (IAM)?
- ▸ IAM Users represent specific people or applications, while Groups allow you to manage permissions for multiple users simultaneously to simplify administration.
- ▸ IAM Roles provide temporary security credentials for users or services, enabling secure access to AWS resources without sharing long-term access keys.
- ▸ Permissions Policies are JSON documents that define what actions are allowed or denied on specific resources, strictly following the principle of least privilege.
- ▸ The Root User has full administrative access; for security, it should be used only for initial setup and always protected by Multi-Factor Authentication.
- ▸ IAM Roles for EC2 allow applications running on instances to securely access other AWS services without embedding hardcoded credentials in the application code.
🎯 How does AWS Identity and Access Management (IAM) appear on the SAA-C03 Exam?
You may be asked to design a secure way for an application on an EC2 instance to upload files to S3; the correct answer involves creating an IAM Role.
A scenario might describe a need to grant a third-party auditing company temporary access to your AWS account; expect to implement a cross-account IAM Role.
Expect questions where you must choose between adding a policy to a user or a group to ensure consistent permissions across a department of developers.
❓ Frequently Asked Questions
What is the primary difference between an IAM User and an IAM Role?
An IAM User is a permanent identity with long-term credentials, whereas a Role is assumed by a trusted entity to obtain temporary security credentials for a specific task.
When should I use a Managed Policy instead of an Inline Policy?
Use AWS Managed Policies for common permissions and Customer Managed Policies for reusability across multiple users or roles, avoiding the rigidity of Inline Policies.