AWS IAM — Identity and Access Management

AWS IAM — Identity and Access Management

AWS Identity and Access Management (IAM) is the security foundation of AWS. It controls who (authentication) can do what (authorization) on which AWS resources.

In Azure terms: IAM = combination of Microsoft Entra ID (authentication) + Azure RBAC (authorization).

Core IAM Concepts

Concept	Description
IAM User	A person or application with permanent credentials (username + password or access keys)
IAM Group	A collection of IAM users — assign policies to the group, not individual users
IAM Role	A set of permissions assumed temporarily — used by services, EC2, Lambda, cross-account
IAM Policy	A JSON document defining Allow or Deny permissions for actions on resources
Access Key	Programmatic credential (Key ID + Secret) for CLI/API access

IAM Policy Structure

Policies are JSON documents with a specific structure:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

Field	Options	Meaning
Effect	Allow or Deny	Whether to permit or block
Action	e.g., s3:GetObject, ec2:*	API operations affected
Resource	ARN or *	Which resources the policy applies to
Condition	Optional	Extra conditions (IP, MFA, time)

Types of IAM Policies

Type	Description
AWS Managed	Pre-built by Amazon (e.g., AmazonS3ReadOnlyAccess)
Customer Managed	Custom policies you create and maintain
Inline Policy	Directly embedded in a user, group, or role (not reusable)
Resource-based	Attached to a resource (e.g., S3 bucket policy, Lambda function policy)
Permission Boundary	Maximum permissions an entity can have
SCP (Service Control Policy)	Organization-level guard-rails via AWS Organizations

IAM Roles — Key Use Cases

Roles are the preferred way to grant permissions to AWS services:

• EC2 Instance Role — Allows an EC2 instance to call S3, DynamoDB, etc. without storing credentials
• Lambda Execution Role — Grants Lambda permission to write CloudWatch logs, access DynamoDB, etc.
• Cross-Account Role — Allow users in Account A to assume a role in Account B
• Federated Identity — Allow users from an external identity provider (Okta, Active Directory) to assume roles

Security Best Practices

1. Never use the root account — Create IAM users immediately and lock the root account
2. Enable MFA — Require MFA for all human users, especially privileged ones
3. Use roles, not access keys — Avoid long-lived credentials; use instance roles and OIDC
4. Principle of least privilege — Grant only the permissions needed for the job
5. Rotate credentials regularly — Rotate access keys and review unused permissions
6. Use IAM Access Analyzer — Detect over-permissive policies and external access
7. Enable CloudTrail — Log all API calls for audit and compliance

Common AWS Managed Policies

Policy	Description
AdministratorAccess	Full access to all AWS services (use sparingly)
PowerUserAccess	Full access except IAM management
ReadOnlyAccess	Read-only access to all services
AmazonS3FullAccess	Full S3 access
AmazonEC2ReadOnlyAccess	Read-only EC2 access
AWSLambdaBasicExecutionRole	Write logs to CloudWatch (for Lambda)

IAM vs Azure RBAC Quick Comparison

Feature	AWS IAM	Azure RBAC
Identity unit	User / Group / Role	User / Group / Service Principal / Managed Identity
Permissions model	Policies (JSON)	Role Definitions (Actions/DataActions)
Service identity	IAM Role	Managed Identity
Root equivalent	Root account	Global Administrator
Cross-account	Cross-account Roles	Azure Lighthouse / Guest access
Audit log	CloudTrail	Azure Activity Log / Entra Audit Logs

CLI Examples

# List all IAM users
aws iam list-users

# Create a new IAM user
aws iam create-user --user-name devuser

# Attach a managed policy to a user
aws iam attach-user-policy \
  --user-name devuser \
  --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

# Create an IAM role for EC2
aws iam create-role \
  --role-name ec2-s3-role \
  --assume-role-policy-document file://trust-policy.json

# Get the current caller identity
aws sts get-caller-identity

Useful Links

• IAM Documentation
• IAM Policy Simulator
• IAM Access Analyzer