AWS Identity and Access Management (IAM)¶

Service Overview and Purpose¶

AWS Identity and Access Management (IAM) is a web service that helps you securely control access to AWS resources. IAM enables you to manage users, groups, roles, and permissions to determine who can access which AWS resources and what actions they can perform.

Core Purpose: - Centralized access control for AWS resources - Fine-grained permissions management - Identity federation and single sign-on - Secure API access through programmatic credentials - Compliance with security best practices

Key Features and Capabilities¶

Core IAM Components¶

Users
Individual identities with permanent credentials
Can have console and/or programmatic access
Belong to groups and can assume roles
Have inline or attached policies
Groups
Collections of users with similar access needs
Policies attached to groups apply to all members
Users can belong to multiple groups
Cannot be nested (groups cannot contain other groups)
Roles
Temporary credentials for trusted entities
Can be assumed by users, services, or external identities
More secure than long-term credentials
Support cross-account access
Policies
JSON documents defining permissions
Can be attached to users, groups, or roles
AWS managed, customer managed, or inline policies
Support conditions and variables

Advanced Features¶

Multi-Factor Authentication (MFA): Additional security layer
Identity Federation: Integration with external identity providers
Access Analyzer: Analyze and validate permissions
Credential Reports: Security audit capabilities
Service Control Policies (SCPs): Organization-wide guardrails
Permission Boundaries: Maximum permissions delegation
IAM Conditions: Context-based access control

Use Cases and Scenarios¶

Primary Use Cases¶

User Management: Create and manage individual user accounts
Service Access: Grant AWS services permissions to access other services
Cross-Account Access: Secure access between AWS accounts
Federated Access: Integration with corporate identity systems
API Security: Secure programmatic access to AWS APIs
Compliance: Meet regulatory and audit requirements
Principle of Least Privilege: Grant minimum necessary permissions
Temporary Access: Provide time-limited access to resources
Emergency Access: Break-glass procedures for critical situations
DevOps Automation: Secure CI/CD pipeline permissions

Scenario Examples¶

Multi-Account Organization: Using cross-account roles for centralized management
Developer Access: Temporary credentials for development environments
Application Integration: Service roles for Lambda functions and EC2 instances
Third-Party Integration: External access through identity federation
Audit and Compliance: Regular access reviews and permission validation

Pricing Models and Cost Optimization¶

Pricing Structure¶

Free Tier
No additional charge for IAM service
50 users and 100 groups included
Unlimited roles and policies
Additional Costs
AWS CloudTrail for API logging (optional)
AWS Config for compliance monitoring (optional)
Third-party integrations and tools

Cost Optimization Strategies¶

Regular Access Reviews: Remove unused users and permissions
Group-Based Management: Reduce policy duplication
Role-Based Access: Use temporary credentials instead of permanent keys
Automated Cleanup: Remove inactive users and unused roles
Monitoring: Track access patterns and optimize permissions
Federation: Reduce user management overhead

Configuration Details and Best Practices¶

IAM Policy Structure¶

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow|Deny",
      "Principal": "arn:aws:iam::account:user/username",
      "Action": "service:action",
      "Resource": "arn:aws:service:region:account:resource",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": ["us-east-1", "us-west-2"]
        }
      }
    }
  ]
}

Best Practices¶

Principle of Least Privilege
Grant minimum necessary permissions
Use specific actions instead of wildcards
Regular permission audits and cleanup
User Management
Enforce strong password policies
Require MFA for console access
Use groups for permission management
Disable unused access keys
Role-Based Access
Use roles for applications and services
Implement cross-account access through roles
Set appropriate session duration
Use external ID for third-party access
Policy Management
Use AWS managed policies when possible
Version control custom policies
Test policies before deployment
Document policy purposes and owners
Monitoring and Auditing
Enable CloudTrail for API logging
Regular credential reports
Monitor failed login attempts
Set up alerts for privilege escalation

Integration with Other AWS Services¶

Core Integrations¶

All AWS Services: IAM controls access to every AWS service
CloudTrail: Logs all IAM API calls and user activities
CloudWatch: Monitors IAM metrics and events
AWS Config: Tracks IAM configuration changes
AWS Organizations: Organization-wide identity management
AWS SSO: Centralized single sign-on solution
Cognito: User identity for applications
Secrets Manager: Secure storage of credentials
Parameter Store: Secure configuration management
Lambda: Execution roles for serverless functions

Advanced Integrations¶

Active Directory: Federation with on-premises AD
SAML Providers: Integration with SAML 2.0 identity providers
OpenID Connect: Web identity federation
AWS CLI/SDK: Programmatic access to AWS services
Terraform/CloudFormation: Infrastructure as code
Third-party Tools: Security scanning and compliance tools

Security Considerations¶

Access Security¶

Root Account Protection: Secure and limit root account usage
MFA Enforcement: Require MFA for sensitive operations
Access Key Rotation: Regular rotation of programmatic credentials
Session Management: Appropriate session timeouts and policies
IP Restrictions: Limit access from specific IP ranges

Data Protection¶

Encryption: Secure transmission of credentials and tokens
Audit Logging: Comprehensive logging of all access attempts
Monitoring: Real-time detection of suspicious activities
Backup: Secure backup of IAM configurations

Compliance¶

SOC: SOC 1, SOC 2, SOC 3 compliance
PCI DSS: Payment card industry security standards
HIPAA: Healthcare information protection
GDPR: European data protection regulation
FedRAMP: Government security requirements

Monitoring and Troubleshooting¶

CloudWatch Metrics¶

SigninFailure: Failed console sign-in attempts
MFAFailure: Failed MFA authentication attempts
AssumeRoleFailure: Failed role assumption attempts
PolicyEvaluationDecision: Policy evaluation results

Common Issues and Solutions¶

Access Denied Errors
Check policy permissions and conditions
Verify principal and resource ARNs
Review permission boundaries and SCPs
Check for explicit deny statements
Role Assumption Failures
Verify trust policy configuration
Check external ID requirements
Validate session duration settings
Review MFA requirements
Policy Conflicts
Understand policy evaluation logic
Check for conflicting policies
Review inline vs. attached policies
Analyze permission boundaries
Federation Issues
Verify SAML/OIDC configuration
Check attribute mappings
Validate certificate configurations
Review trust relationships

Monitoring Tools¶

AWS CloudTrail: API call logging and analysis
AWS Config: Configuration compliance monitoring
Access Analyzer: External access validation
Credential Report: User credential status
Third-party: Splunk, Datadog, CrowdStrike

Exam-Specific Tips and Common Scenarios¶

Solutions Architect Associate (SAA-C03)¶

Cross-Account Access: Using roles for secure account-to-account access
Federated Access: Integrating with corporate identity systems
Service Permissions: Granting AWS services access to other services
Security Best Practices: MFA, least privilege, credential management

Solutions Architect Professional (SAP-C02)¶

Complex Policies: Advanced policy conditions and variables
Organization Management: AWS Organizations and SCPs
Identity Strategy: Enterprise identity architecture
Compliance: Regulatory requirements and audit strategies

Security Specialty (SCS-C02)¶

Advanced IAM: Permission boundaries, access analyzer
Incident Response: Security incident handling procedures
Compliance Monitoring: Automated compliance checking
Threat Detection: Integration with security services

Developer Associate (DVA-C02)¶

Application Security: Secure API access and SDK usage
Credential Management: Best practices for application credentials
Role-Based Access: Using roles in application development
Debugging: Troubleshooting permission issues

Common Exam Scenarios¶

Scenario: Grant temporary access to external contractor Solution: Create role with external ID and time-limited permissions
Scenario: Secure cross-account S3 bucket access Solution: Use cross-account IAM role with bucket policies
Scenario: Integrate with corporate Active Directory Solution: Configure SAML federation with AD FS
Scenario: Automate user provisioning and deprovisioning Solution: Use AWS SSO with SCIM protocol integration

Hands-on Examples and CLI Commands¶

User Management¶

# Create a new user
aws iam create-user --user-name developer

# Create access key for user
aws iam create-access-key --user-name developer

# Add user to group
aws iam add-user-to-group --user-name developer --group-name developers

# Delete user (must remove from groups and delete access keys first)
aws iam remove-user-from-group --user-name developer --group-name developers
aws iam delete-access-key --user-name developer --access-key-id AKIAIOSFODNN7EXAMPLE
aws iam delete-user --user-name developer

# List users
aws iam list-users

# Get user details
aws iam get-user --user-name developer

Group Management¶

# Create group
aws iam create-group --group-name developers

# Attach policy to group
aws iam attach-group-policy --group-name developers --policy-arn arn:aws:iam::aws:policy/PowerUserAccess

# List groups
aws iam list-groups

# Get group details
aws iam get-group --group-name developers

# Delete group (must remove all users first)
aws iam detach-group-policy --group-name developers --policy-arn arn:aws:iam::aws:policy/PowerUserAccess
aws iam delete-group --group-name developers

Role Management¶

# Create role with trust policy
cat > trust-policy.json << EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF

aws iam create-role --role-name EC2S3ReadOnlyRole --assume-role-policy-document file://trust-policy.json

# Attach policy to role
aws iam attach-role-policy --role-name EC2S3ReadOnlyRole --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

# Create instance profile
aws iam create-instance-profile --instance-profile-name EC2S3ReadOnlyProfile

# Add role to instance profile
aws iam add-role-to-instance-profile --instance-profile-name EC2S3ReadOnlyProfile --role-name EC2S3ReadOnlyRole

# List roles
aws iam list-roles

# Delete role (remove from instance profiles and detach policies first)
aws iam remove-role-from-instance-profile --instance-profile-name EC2S3ReadOnlyProfile --role-name EC2S3ReadOnlyRole
aws iam delete-instance-profile --instance-profile-name EC2S3ReadOnlyProfile
aws iam detach-role-policy --role-name EC2S3ReadOnlyRole --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
aws iam delete-role --role-name EC2S3ReadOnlyRole

Policy Management¶

# Create custom policy
cat > custom-policy.json << EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}
EOF

aws iam create-policy --policy-name S3CustomAccess --policy-document file://custom-policy.json

# List policies
aws iam list-policies --scope Local

# Get policy details
aws iam get-policy --policy-arn arn:aws:iam::123456789012:policy/S3CustomAccess

# Get policy version
aws iam get-policy-version --policy-arn arn:aws:iam::123456789012:policy/S3CustomAccess --version-id v1

# Create new policy version
aws iam create-policy-version --policy-arn arn:aws:iam::123456789012:policy/S3CustomAccess --policy-document file://updated-policy.json --set-as-default

# Delete policy
aws iam delete-policy --policy-arn arn:aws:iam::123456789012:policy/S3CustomAccess

MFA Configuration¶

# Enable MFA device for user
aws iam enable-mfa-device --user-name developer --serial-number arn:aws:iam::123456789012:mfa/developer --authentication-code-1 123456 --authentication-code-2 789012

# List MFA devices
aws iam list-mfa-devices --user-name developer

# Deactivate MFA device
aws iam deactivate-mfa-device --user-name developer --serial-number arn:aws:iam::123456789012:mfa/developer

# Create virtual MFA device
aws iam create-virtual-mfa-device --virtual-mfa-device-name developer-mfa --outfile QRCode.png --bootstrap-method QRCodePNG

Access Analysis¶

# Generate credential report
aws iam generate-credential-report

# Get credential report
aws iam get-credential-report --output text --query 'Content' | base64 -d > credential-report.csv

# List access keys
aws iam list-access-keys --user-name developer

# Get last accessed information
aws iam get-service-last-accessed-details --job-id 12345678-1234-1234-1234-123456789012

# Simulate policy
aws iam simulate-principal-policy --policy-source-arn arn:aws:iam::123456789012:user/developer --action-names s3:GetObject --resource-arns arn:aws:s3:::my-bucket/file.txt

Cross-Account Role Assumption¶

# Assume role in another account
aws sts assume-role --role-arn arn:aws:iam::123456789012:role/CrossAccountRole --role-session-name CrossAccountSession

# Use temporary credentials
export AWS_ACCESS_KEY_ID=ASIAIOSFODNN7EXAMPLE
export AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYzEXAMPLEKEY
export AWS_SESSION_TOKEN=AQoEXAMPLEH4aoAH0gNCAPyJxz4BlCFFxWNE1OPTgk5TthT+FvwqnKwRcOIfrRh3c/LTo6UDdyJwOOvEVPvLXCrrrUtdnniCEXAMPLE/IvU1dYUg2RVAJBanLiHb4IgRmpRV3zrkuWJOgQs8IZZaIv2BXIa2R4OlgkBN9bkUDNCJiBeb/AXlzBBko7b15fjrBs2+cTQtpZ3CYWFXG8C5zqx37wnOE49mRl/+OtkIKGO7fAE

# Get caller identity
aws sts get-caller-identity

This comprehensive IAM documentation covers all essential aspects for AWS certification preparation, providing both theoretical understanding and practical implementation examples.