IAM and Security

IAM and Security

Identity and Access Management (IAM) is the foundation of AWS security. It controls who can access what resources and what actions they can perform. Getting IAM right is critical — misconfigured IAM is one of the top causes of cloud security breaches.

IAM Components

  ┌─────────────────────────────────────────────────────┐
  │                IAM STRUCTURE                         │
  │                                                     │
  │  Root Account (you)                                 │
  │     │                                               │
  │     ├── Users (individuals)                         │
  │     │    └── Access keys + password                 │
  │     │                                               │
  │     ├── Groups (collections of users)               │
  │     │    └── Developers, Admins, Analysts           │
  │     │                                               │
  │     ├── Roles (assumed by users/services)           │
  │     │    └── EC2 role, Lambda role, Cross-account   │
  │     │                                               │
  │     └── Policies (JSON permission documents)        │
  │          └── Allow/Deny specific actions            │
  │                                                     │
  │  ┌──────────────────────────────────────────────┐   │
  │  │  {                                            │   │
  │  │    "Effect": "Allow",                        │   │
  │  │    "Action": "s3:GetObject",                 │   │
  │  │    "Resource": "arn:aws:s3:::my-bucket/*"    │   │
  │  │  }                                            │   │
  │  └──────────────────────────────────────────────┘   │
  └─────────────────────────────────────────────────────┘

Best Practices

Enable MFA: Multi-factor authentication adds a second layer of security. Enable it on all users, especially the root account.

Use least privilege: Grant only the permissions needed for the task. Start restrictive, add permissions as needed.

Use roles over access keys: IAM roles are safer than long-lived access keys. EC2 instances and Lambda functions should use roles.

Rotate credentials: Regularly rotate access keys and passwords. Use AWS Secrets Manager for automatic rotation.

Audit with CloudTrail: Log all API calls to detect suspicious activity.

IAM Policy Example

  Allow read-only access to a specific S3 bucket:
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "s3:GetObject",
          "s3:ListBucket"
        ],
        "Resource": [
          "arn:aws:s3:::my-app-bucket",
          "arn:aws:s3:::my-app-bucket/*"
        ]
      }
    ]
  }

  Deny access to everything except specific services:
  (Use SCP or permission boundaries)

Root Account Protection

Your root account has full access to everything. Lock it down: enable MFA, never use it for daily tasks, create an admin user for everyday work, and set up billing alerts to detect unauthorized usage.