IAM(Identity and Access Management)

AWS Identity and Access Management (IAM) is a web service that helps you manage users and permissions in AWS. IAM users can be individuals or applications, and they can have different levels of access to your AWS resources.

For example,

You can create an IAM user with permission to only access your Amazon S3 buckets, or you can create an IAM user with permission to access all of your AWS resources.

How does AWS IAM work?

AWS IAM uses policies to define permissions. A policy is an object that specifies what actions a user or role can take on a resource.

For example,

A policy could allow a user to create, read, update, and delete objects in an Amazon S3 bucket.

When a user or role requests an AWS service, AWS IAM evaluates the policies associated with that user or role to determine whether the request is allowed or denied.

What are the benefits of using AWS IAM?

• Centralized user management: This makes it easier to track who has access to your AWS resources and what permissions they have.

• Fine-grained access control: This means that you can grant users and roles specific permissions to specific resources, rather than granting them blanket access to all of your resources.

• Multi-factor authentication (MFA): MFA requires users to enter a code from a physical device in addition to their password when they sign in to their AWS account.

• Role-based access control (RBAC): Assign permissions to users and roles based on their job function or role within your organization. This can help you to simplify your access control management and make it easier to comply with security best practices.

AWS IAM policy

Below AWS IAM policy allows a user to create, read, update, and delete objects in an Amazon S3 bucket:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:CreateBucket",
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject"
      ],
      "Resource": [
        "arn:aws:s3:::my-bucket"
      ]
    }
  ]
}

This policy allows the user to perform the following actions on the Amazon S3 bucket named my-bucket:

• Create a bucket

• Put an object in the bucket

• Get an object from the bucket

• Delete an object from the bucket