AWS — IAM

What is IAM?

Manages access to AWS services and resources securely.

Key concepts

• Users: Individual accounts
• Groups: Collections of users
• Roles: Temporary access
• Policies: Permission documents

Create user

aws iam create-user --user-name john

# Create access key
aws iam create-access-key --user-name john

Create group

aws iam create-group --group-name developers

# Add user to group
aws iam add-user-to-group --user-name john --group-name developers

Attach policy

# Managed policy
aws iam attach-group-policy \
  --group-name developers \
  --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess

# Custom policy
aws iam put-group-policy \
  --group-name developers \
  --policy-name custom-policy \
  --policy-document file://policy.json

Policy document

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

Roles

# Create role
aws iam create-role \
  --role-name EC2-Role \
  --assume-role-policy-document file://trust-policy.json

# Attach to EC2
aws iam attach-role-policy \
  --role-name EC2-Role \
  --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

Best practices

1. Enable MFA
2. Use least privilege
3. Rotate credentials
4. Audit with CloudTrail

Mini Practice

1. Create an IAM user
2. Create a group with policies
3. Create a role for EC2
4. Test permissions

Up Next

Continue with EC2 - Virtual Servers.