Access management capabilities

IAM controls who can do what in your account. Protect the root user, grant least privilege, prefer temporary credentials, and use IAM Identity Center for workforce sign-in.

IAM building blocks

• Users: An identity for one person or application with long-term credentials (password and/or access keys).
• Groups: Collections of users; attach policies to a group to manage permissions for many users at once.
• Roles: Identities with temporary credentials that users, applications, AWS services, or other accounts assume. Cross-account roles let one account access another without sharing keys.
• Policies: JSON documents that allow or deny actions on resources. AWS managed policies are prebuilt by AWS; customer managed (custom) policies are written by you for precise least-privilege access.
• Principle of least privilege: Grant only the permissions needed to do a task, and nothing more.

Protecting the root user

• The root user is the email-and-password identity that created the account and has full access. Don't use it for everyday work.
• Protect it with a strong password and MFA, don't create root access keys (delete any that exist), and use it only for root-only tasks.
• Examples of root-only tasks: changing the root email address, root password, or root access keys (standalone accounts); closing a standalone account; restoring IAM permissions if the only admin locked themselves out; activating IAM access to the Billing console; registering as a seller in the Reserved Instance Marketplace; enabling MFA Delete on an S3 bucket.
• In AWS Organizations, centralized root access lets the management account remove root credentials from member accounts.

Credentials and authentication

• Access keys: Long-term credentials for programmatic access (CLI, SDK). Rotate them, never embed them in code, and prefer roles with temporary credentials.
• Password policies: Set IAM password complexity, length, and rotation rules.
• Credential storage: AWS Secrets Manager stores secrets such as database passwords and can rotate them automatically. AWS Systems Manager Parameter Store stores configuration and secrets (SecureString).
• Multi-factor authentication (MFA): Adds a second factor (authenticator app, security key) to sign-in.
• AWS IAM Identity Center: The recommended way to give your workforce single sign-on access to multiple AWS accounts and business apps, with users from its own directory or an external identity provider.
• Federation: Users sign in with an existing identity provider (for example, a corporate directory using SAML) and get temporary AWS access, so you don't create IAM users for them.
• Amazon Cognito: Sign-up and sign-in for the end users of your own web and mobile apps.

Policies in practice

• By default, everything is denied. A policy must explicitly allow an action, and an explicit deny always overrides any allow.
• Identity-based policies: Attached to users, groups, or roles; say what that identity can do.
• Resource-based policies: Attached to a resource such as an S3 bucket policy; say who can access that resource, including other accounts.
• Service control policies (SCPs): Used in AWS Organizations to set the maximum permissions for accounts in the organization. They don't grant permissions by themselves.
• Start with AWS managed policies for common job functions, then move to customer managed policies scoped to exactly what's needed. Review unused permissions with IAM access advisor.

Types of identity management

• Workforce identities: Employees and contractors who access AWS accounts: manage them centrally with IAM Identity Center, often federated with a corporate directory.
• Customer identities: Users of your own applications: manage them with Amazon Cognito, which also supports social sign-in.
• AWS Directory Service: Managed Microsoft Active Directory in AWS, or a connector to an existing on-premises Active Directory.
• Cross-account access: Create a role in the target account that trusts the other account; users assume it to get temporary credentials.
• AWS Resource Access Manager (AWS RAM): Share resources such as subnets or Transit Gateways with other accounts instead of duplicating them.