(IAM)Identity and Access Management in AWS
Introduction:
Identity and Access Management (IAM) is a crucial component of Amazon Web Services (AWS), which is a cloud computing platform offered by Amazon. IAM allows you to manage user access and permissions to AWS resources such as EC2 instances, S3 buckets, and RDS databases.
In AWS, each user is identified by their unique AWS account number and an associated email address. IAM enables you to create and manage AWS users and groups, and assign specific permissions to them. You can also control access to AWS resources based on various factors such as time of day, source IP address, and protocols used.
IAM allows you to implement the principle of least privilege, which means that users are granted only the minimum necessary permissions to perform their tasks. This reduces the risk of unauthorized access and potential security breaches.
IAM also provides features such as multi-factor authentication (MFA) and integration with external identity providers such as Active Directory, which further enhance security and simplify user management.
In summary, IAM is a powerful tool in AWS that enables you to manage user access and permissions to AWS resources, implement the principle of least privilege, and enhance security through features such as MFA and integration with external identity providers.
This article focuses on the following pointers:
- What is IAM
- IAM features
- Accessing IAM
What is IAM?
IAM stands for Identity and Access Management, which is a web service offered by Amazon Web Services (AWS). IAM allows you to manage access to AWS resources by creating and managing users, groups, and roles. It provides a centralized control over AWS resources and allows you to grant or deny access to resources based on specific permissions.
With IAM, you can create individual IAM users and manage their permissions, as well as define roles and policies that determine what actions can be performed on specific AWS resources. IAM also provides features such as multi-factor authentication (MFA), which adds an extra layer of security to AWS resources, and integration with external identity providers such as Active Directory, which allows you to manage access to AWS resources using your existing corporate directory.
IAM enables you to implement the principle of least privilege, which means that users are granted only the minimum necessary permissions to perform their tasks. This helps to reduce the risk of unauthorized access and potential security breaches.
Overall, IAM is a powerful tool that allows you to manage access to AWS resources in a secure and flexible manner.
IAM features
IAM gives you the following features:
Shared access to your AWS account
You can grant other people permission to administer and use resources in your AWS account without having to share your password or access key.
Granular permissions
You can grant different permissions to different people for different resources. For example, you might allow some users complete access to Amazon Elastic Compute Cloud (Amazon EC2), Amazon Simple Storage Service (Amazon S3), Amazon DynamoDB, Amazon Redshift, and other AWS services. For other users, you can allow read-only access to just some S3 buckets, or permission to administer just some EC2 instances, or to access your billing information but nothing else.
Secure access to AWS resources for applications that run on Amazon EC2
You can use IAM features to securely provide credentials for applications that run on EC2 instances. These credentials provide permissions for your application to access other AWS resources. Examples include S3 buckets and DynamoDB tables.
Multi-factor authentication (MFA)
You can add two-factor authentication to your account and to individual users for extra security. With MFA you or your users must provide not only a password or access key to work with your account, but also a code from a specially configured device. If you already use a FIDO security key with other services, and it has an AWS supported configuration, you can use WebAuthn for MFA security. For more information, see Supported configurations for using FIDO security keys.
Identity federation
You can allow users who already have passwords elsewhere—for example, in your corporate network or with an internet identity provider—to get temporary access to your AWS account.
Identity information for assurance
If you use AWS CloudTrail, you receive log records that include information about those who made requests for resources in your account. That information is based on IAM identities.
PCI DSS Compliance
IAM supports the processing, storage, and transmission of credit card data by a merchant or service provider, and has been validated as being compliant with Payment Card Industry (PCI) Data Security Standard (DSS). For more information about PCI DSS, including how to request a copy of the AWS PCI Compliance Package, see PCI DSS Level 1.
Integrated with many AWS services
For a list of AWS services that work with IAM, see AWS services that work with IAM.
Eventually Consistent
IAM, like many other AWS services, is eventually consistent. IAM achieves high availability by replicating data across multiple servers within Amazon’s data centers around the world. If a request to change some data is successful, the change is committed and safely stored. However, the change must be replicated across IAM, which can take some time.
Such changes include creating or updating users, groups, roles, or policies. We recommend that you do not include such IAM changes in the critical, high-availability code paths of your application. Instead, make IAM changes in a separate initialization or setup routine that you run less frequently. Also, be sure to verify that the changes have been propagated before production workflows depend on them. For more information, see Changes that I make are not always immediately visible.
Free to use
AWS Identity and Access Management (IAM) and AWS Security Token Service (AWS STS) are features of your AWS account offered at no additional charge. You are charged only when you access other AWS services using your IAM users or AWS STS temporary security credentials. For information about the pricing of other AWS products, see the Amazon Web Services pricing page.
Accessing IAM
You can work with AWS Identity and Access Management in any of the following ways.
AWS Management Console
The console is a browser-based interface to manage IAM and AWS resources. For more information about accessing IAM through the console, see Signing in to the AWS Management Console as an IAM user or root user.
AWS Command Line Tools
You can use the AWS command line tools to issue commands at your system’s command line to perform IAM and AWS tasks. Using the command line can be faster and more convenient than the console. The command line tools are also useful if you want to build scripts that perform AWS tasks.
AWS provides two sets of command line tools: the AWS Command Line Interface (AWS CLI) and the AWS Tools for Windows PowerShell. For information about installing and using the AWS CLI, see the AWS Command Line Interface User Guide. For information about installing and using the Tools for Windows PowerShell, see the AWS Tools for Windows PowerShell User Guide.
AWS SDKs
AWS provides SDKs (software development kits) that consist of libraries and sample code for various programming languages and platforms (Java, Python, Ruby, .NET, iOS, Android, etc.). The SDKs provide a convenient way to create programmatic access to IAM and AWS. For example, the SDKs take care of tasks such as cryptographically signing requests, managing errors, and retrying requests automatically. For information about the AWS SDKs, including how to download and install them, see the Tools for Amazon Web Services page.
IAM HTTPS API
You can access IAM and AWS programmatically by using the IAM HTTPS API, which lets you issue HTTPS requests directly to the service. When you use the HTTPS API, you must include code to digitally sign requests using your credentials. For more information, see Calling the IAM API using HTTP query requests and the IAM API Reference.
