Table of contents
Introduction
Definition of AWS Identity and Access Management (IAM)
Importance of IAM in AWS
IAM Components
Users
Groups
Roles
Policies
Access keys
Multi-Factor Authentication
Conclusion
Definition of AWS Identity and Access Management (IAM)
Identity and Access Management is a web service provided by AWS that allows administrators to manage access to AWS resources. IAM enables the creation and management of users, groups, and roles and assigning permissions to these entities. It also provides a way to set up secure access to your AWS resources by creating and managing access keys and security credentials such as access keys, secret access keys, and the MFA.
It is a global service that applies to all of an organization's regions and accounts. It allows you to control access to AWS resources and services, using policies that specify what actions are permitted or denied for each user or group. It also integrates with other AWS services, such as Amazon S3 and Amazon EC2, to provide additional security features, such as encryption and access controls.
Importance of IAM in AWS
IAM enables you to secure your AWS infrastructure by controlling access to resources. It helps customers comply with security and compliance regulations by providing fine-grained control over who can access what resources and actions they can perform.
IAM manages access and permissions, which helps to ensure that solely authorized users can access sensitive data and systems. It also provides a way to manage temporary access to resources through IAM roles, which can be helpful in scenarios such as allowing third-party services to access your resources.
Additionally, IAM enables customers to apply security best practices like the principle of least privilege, which states that users should have the minimum permissions necessary to perform their job.
It is, without doubt, one of the building blocks of security on AWS.
IAM Components
AWS Identity and Access Management (IAM) has several components that can be used to manage access to AWS resources:
Users
In IAM, a user represents an individual or system that needs to access AWS resources. Each user is identified by a unique name and associated with a set of security credentials, such as an access key and a secret key.
Users can be created and managed through the IAM console, AWS CLI, or SDKs. Once a user is created, the administrator can assign permissions to the user, determining what actions the user can perform on what resources.
Users can be organized into groups, which makes it easier to manage permissions for multiple users at once. For example, you can create a group for all the users in a specific department and then assign permissions to that group.
Users can be assigned roles similar to users but not associated with a specific person or entity. Instead, roles are intended to be assumed by AWS services, applications, or users in other AWS accounts.
Users can also be granted temporary access to resources by assuming a role, which enables them to take on the permissions of that role. This is useful for scenarios such as cross-account or federated access to your AWS resources through an identity provider such as Active Directory.
Groups
Groups are collections of IAM users that can be assigned permissions as a group. This allows you to manage permissions for multiple users at once.
Groups are created within IAM, and users are added to them. Once a user is a group member, they inherit the permissions assigned to that group. This means you can assign permissions to a group, and all users will have those permissions.
You can use groups to organize and manage your users based on their job function or department. For example, you might create a group for 'Developers' and another for 'Managers.' You can then assign different permissions to each group so that developers have the permissions they need to work with your application code. In contrast, managers have the permissions they need to manage the application.
Roles
A role is similar to a user but not associated with a specific person or entity. Instead, roles are intended to be assumed by AWS services, applications, or users in other AWS accounts.
A role is a set of permissions that determine what actions can be performed on which resources. Roles can be created and managed through the IAM console, the AWS CLI, or the AWS SDKs. Once created, a user, an AWS service, or an application can assume a role.
Roles are useful in scenarios such as:
Cross-account access: If you have multiple AWS accounts, you can use roles to grant users in one account access to resources in another account.
Federated access: You can use roles to grant users in your organization access to your AWS resources through an identity provider such as Active Directory.
Service-linked roles: Some AWS services, such as Elastic Container Service (ECS) and Elastic Beanstalk, have specific roles linked directly to the service. The service automatically creates and manages these roles and cannot be modified or deleted.
EC2 Instance Profile: You can use roles to grant permissions to your EC2 instances so that applications running on the cases can access other AWS resources.
AWS Resource Access Manager: You can use roles to grant permissions to resources in one AWS account to users in another account.
Policies
A policy is a set of rules that determine what actions a user, group, or role can perform on what resources. Policies are written in JSON and can be attached to users, groups, and roles.
Policies are the building blocks of IAM. They define a user, group, or role's permissions to access AWS resources. Policies are made up of statements that specify the actions allowed or denied on a particular resource or set of resources. Policies can be created and managed through the IAM console, the AWS CLI, or the AWS SDKs.
There are two types of policies:
Managed policies: These are policies that are created and managed by AWS. They include pre-defined policies for everyday use cases, such as read-only access to S3 or full access to EC2.
Inline policies: These are policies that are embedded directly in a user, group, or role. They allow you to grant fine-grained permissions specific to a user, group, or role.
Policies can be used to grant permissions for a wide range of AWS services, such as Amazon S3, Amazon EC2, and AWS Lambda. They can also be used to grant permissions for specific resources, such as one particular S3 bucket or EC2 instance.
Access keys
As seen above, access keys consist of an access key ID and a secret access key. These keys are used to make programmatic calls to AWS services using the AWS SDKs, the AWS CLI, and other tools. Access keys are associated with an IAM user or the AWS account root user. Users can have multiple access keys, but only one set can be active.
They are used to authenticate when making API requests and are typically used in conjunction with the AWS SDKs and the AWS CLI. Access keys are used to sign the requests, and the service uses the key to identify the sender and verify that the request is authentic.
You can create and manage access keys for IAM users through the AWS Management Console, AWS CLI, or AWS API. When creating access keys, it is vital to store the secret key in a secure location and rotate them regularly as a security best practice.
It's important to note that access keys should be protected and kept secret. They should never be shared and should be rotated regularly as a security best practice. It is also important to know that IAM access keys are intended for use with the AWS API, CLI, and SDKs and are not meant to be used for logging into the AWS Management Console.
Multi-Factor Authentication (MFA)
Multi-Factor Authentication is an IAM component in AWS that is an additional layer of security that requires a user to provide a one-time password in addition to their username and password. MFA adds an extra authentication step, making it more difficult for unauthorized users to access your AWS resources.
MFA can be enabled for IAM users through the AWS Management Console, AWS CLI, or AWS API. In addition, different types of MFA devices are available, such as a hardware token or a virtual device that runs on a smartphone. Once MFA is enabled, users will be prompted for a one-time password when they sign in to the Console or make programmatic calls to AWS services using their access keys.
You can enable MFA on the AWS account root user, IAM users, or on a role. By doing so, you will ensure that only users who have provided the correct MFA code can sign in or make changes to the resources.
It's worth noting that MFA can be used in conjunction with other security measures, such as access keys and roles, to provide an additional layer of protection for your AWS resources.
Conclusion
These are the core components of IAM, but there are additional features like Identity Federation, Service Control Policies, and Resource-level permissions. Together, these components provide a comprehensive system for managing access to AWS resources and ensuring that only authorized users have access to sensitive data and systems.
I hope you found this useful. If you enjoyed this, please like and share. Thank you!