IAM: Identity Access & Management (IAM)

What Is IAM?

IAM: Users & Groups

IAM Users IAM Groups
Unique identity for accessing AWS services. Logical grouping of users to apply common permissions.
Each user has individual permissions based on policies. Adding/removing users from groups automatically changes their permissions.

IAM: Permissions

IAM Policies Inheritance

IAM Policies Inheritance

Policy Type Description
Inline Policies Directly attached to a single user, group, or role.
Managed Policies Reusable policies created and maintained by AWS (AWS-managed) or the customer (Customer-managed).
Group Inherited Policies Policies assigned to groups apply to all users in that group.

IAM Policies Structure

Example IAM Policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::example-bucket"
    }
  ]
}

IAM – Password Policy

Common Password Policy Settings:

  1. Minimum password length: Set a minimum number of characters (e.g., at least 8 characters).
  2. Require specific character types:
    • Lowercase letters.
    • Uppercase letters.
    • Numbers.
    • Non-alphanumeric characters (special symbols like !, @, #).
  3. Prevent password reuse: Enforce that new passwords cannot be the same as recently used passwords (e.g., prevent using the last 3 passwords).
  4. Password expiration: Set the password to expire after a certain period (e.g., 90 days) to prompt users to change their passwords.
  5. Enable Multi-Factor Authentication (MFA): Enforce MFA for extra security, requiring both a password and a second authentication factor.

IAM Roles for Services

IAM Security Tools

  1. IAM Credential Report:
    • A report that provides details about all IAM users in the AWS account, including the status of their passwords and access keys.
    • Useful for auditing and reviewing user credentials.
  2. IAM Access Advisor:
    • Shows service permissions granted to a user and indicates the last time those permissions were used.
    • Helps identify unnecessary permissions that can be revoked for least privilege.
  3. IAM Policy Simulator:
    • A tool that lets you test and validate the impact of IAM policies before applying them to users, groups, or roles.
    • Helps to understand which actions are allowed or denied based on current policies.

IAM Guidelines & Best Practices

  1. Follow the Principle of Least Privilege:
    • Grant only the permissions required to perform a specific task.
    • Regularly review and adjust permissions as needed.
  2. Enable Multi-Factor Authentication (MFA):
    • Enforce MFA for privileged IAM users (e.g., admin accounts).
    • Adds an additional layer of security by requiring users to provide a code from an MFA device along with their password.
  3. Use IAM Roles Instead of IAM Users for Applications:
    • Assign roles to AWS resources instead of using IAM user credentials in code or configuration files.
    • Prevents security issues that could arise from accidental exposure of long-term credentials.
  4. Rotate IAM Credentials Regularly:
    • Regularly rotate IAM access keys and passwords.
    • Remove unused credentials to reduce risk.
  5. Use AWS Managed Policies for Common Use Cases:
    • AWS provides a set of predefined managed policies that are regularly updated.
    • Managed policies are designed for common use cases and provide a good starting point for granting permissions.

Shared Responsibility Model for IAM

AWS Responsibility Customer Responsibility
Protect physical data centers and global infrastructure. Manage and secure IAM user accounts and access keys.
Maintain the availability of IAM service. Implement strong password policies and enable MFA.
Provide IAM managed policies for common scenarios. Ensure IAM permissions are correctly configured and follow the principle of least privilege.

Multi-Factor Authentication (MFA)

Benefits of MFA

MFA Devices Options in AWS

AWS supports several types of MFA devices:

MFA Device Type Description
Virtual MFA Device Uses apps like Google Authenticator or Authy. Generates a time-based one-time password (TOTP) on a smartphone or tablet.
Hardware MFA Device Physical devices like Gemalto tokens that generate time-based codes.
U2F Security Key USB devices supporting the Universal 2nd Factor (U2F) standard. Typically used for browser-based sign-ins.
AWS Multi-Factor Authentication (MFA) AWS offers its own MFA solutions integrated with IAM to easily configure and manage MFA devices for users.

How Can Users Access AWS?

AWS provides multiple ways for users to access resources:

Access Method Description
AWS Management Console A web-based user interface for interacting with and managing AWS resources visually. Best for beginners and infrequent tasks.
AWS Command Line Interface (CLI) A unified tool to interact with AWS services using commands in your terminal. Suitable for automation and developers.
AWS Software Development Kits (SDKs) Language-specific APIs for programmatically accessing AWS services using programming languages like Python, JavaScript, Java, Ruby, etc.
AWS CloudFormation A service to define and provision AWS infrastructure using code (Infrastructure as Code – IaC). Allows creating stacks and automating deployment configurations.
AWS Mobile Console Provides mobile access to manage AWS services on-the-go.

What’s the AWS CLI?

Key Features of AWS CLI:

  1. Command automation: Write scripts to automate frequent AWS tasks.
  2. Access to all services: Interact with any AWS service and manage resources from the command line.
  3. Profile management: Manage multiple AWS accounts using different named profiles.
  4. JSON and YAML output: Format CLI responses for better readability or integration with other tools.

Example Commands:

# List all S3 buckets in your account
aws s3 ls

# Describe EC2 instances in a specific region
aws ec2 describe-instances --region us-west-2

What’s the AWS SDK?

Key Features of AWS SDK:

Example Usage (Python boto3 SDK):

import boto3

# Create an S3 client
s3 = boto3.client('s3')

# List all S3 buckets
response = s3.list_buckets()
print('S3 Buckets:', [bucket['Name'] for bucket in response['Buckets']])

IAM Section – Summary