Identity and Access Management on AWS

Identity and Access Management (IAM) on AWS is a fundamental service that helps you securely manage access to AWS services and resources. It enables you to control who is authenticated (signed in) and authorized (has permissions) to use AWS resources. Here’s a breakdown of the core components and best practices:

🔑 Core Concepts of IAM

1. Users
   • Represents individual people or services.
   • Associated with credentials (password, access keys).
   • Should not be used for applications in production; use roles instead.
2. Groups
   • Collections of IAM users.
   • You assign permissions to groups, and all users in the group inherit those permissions.
3. Policies
   • JSON documents that define permissions.
   • Can be attached to users, groups, or roles.
   • Types:
     • Managed Policies (AWS-managed or customer-managed)
     • Inline Policies (embedded directly into a single user, group, or role)
4. Roles
   • IAM identities that can be assumed by users, services, or applications.
   • Ideal for granting temporary access.
   • Common use cases:
     • EC2 instances assuming roles
     • Cross-account access
     • Federation with external identity providers (SAML, OIDC)
5. Identity Providers (IdPs)
   • Allows federation with external identities like:
     • Microsoft Active Directory
     • Google Workspace
     • Okta, Azure AD
     • SAML 2.0 or OIDC-compatible IdPs
6. Temporary Security Credentials
   • Provided via STS (Security Token Service)
   • Enables short-lived access to AWS resources

🔐 Security Best Practices

1. Use least privilege principle: Grant only the permissions needed.
2. Enable MFA (Multi-Factor Authentication) for all users.
3. Use roles for applications instead of hardcoding access keys.
4. Rotate credentials regularly, especially access keys.
5. Use IAM Access Analyzer to audit and validate permissions.
6. Monitor with CloudTrail and AWS Config for changes in IAM.
7. Avoid root account for daily tasks; use it only for initial setup and create IAM users or roles afterward.

⚙️ Advanced IAM Features

• Service Control Policies (SCPs): Part of AWS Organizations; restrict what actions accounts within an organization can perform.
• Permission Boundaries: Limit the maximum permissions an IAM user or role can have.
• IAM Conditions: Allow fine-grained access control (e.g., only from certain IPs, using MFA, or during a specific time).
• Attribute-Based Access Control (ABAC): Grant permissions based on tags.

🚀 Common Use Cases

• Assigning a role to an EC2 instance to access S3 without access keys.
• Using Cognito with IAM roles for federated mobile app authentication.
• Setting up cross-account access between dev and prod environments.
• Enforcing security policies across accounts with SCPs in Organizations.