IAM – Identity and Access Management –
Summary
Users: mapped to a physical user. Has a password for AWS Console.
Groups: contains users only
Policies: JSON document that outlines permissions for users or groups
Roles: for EC2 instances or AWS services
Security: MFA + Password Policy
AWS CLI: manage your AWS services using command-line
AWS SDK: manage your AWS services using a programming language
Access Keys: access AWS using the CLI or SDK
Audit: IAM Credential Reports & IAM Access Advisor
IAM Best Practices
Don’t use the root account except for AWS account setup
One physical user = one AWS user
Assign users to groups and assign permissions to groups
Create a strong password policy
Use and enforce the use of MFA
Create and use Roles for giving permissions to AWS services
Use Access Keys for CLI/SDK
Audit permissions of your account using IAM Credentials Report and IAM
Access Advisor
Never share IAM users and Access Keys
Shared Responsibility Model for IAM
AWS is responsible for everything that they do:
Infrastructure – global network security
Configuration and vulnerability analysis
Compliance validation
Regarding IAM you are responsible for:
Creating your own users, your groups, roles, policies, the management of
these policies and the monitoring of that.
Enable MFA on all accounts
Rotate all your keys often
Use IAM tools to apply appropriate permissions
Analyze access patterns and review permissions
