🔐 Day 11/30: Cloud Security & IAM — Who Can Access What in AWS? ☁️
What happens when everyone in your cloud has administrator access? 🤔 Explore how AWS IAM, roles, policies, and the principle of least privilege help protect cloud resources. Join the discussion: Should an EC2 application server have full AWS access, or only the permissions it needs — and why? 💬
Series: Cloud Computing (24 articles)
- …
- 12🔐 Day 11/30: Cloud Security & IAM — Who Can Access What in AWS? ☁️ This article
🔐 Day 11/30: Cloud Security & IAM — Who Can Access What in AWS? ☁️
🎮 Mission 11: Stop the Cloud Intruders!
Imagine this…
It’s the night before the college examination registration deadline. Rahul has finally connected the college portal to AWS. 🌐
The application is running. The database is working. Students can register for exams.
Everything looks perfect!
But suddenly, the college administrator discovers something terrifying…
🚨 A student can view another student's exam results.
🚨 A developer can accidentally delete important files.
🚨 An application server has permission to access data it doesn't need.
The problem isn't the network. The problem is who has permission to do what!
Welcome to Day 11 of our 30-Day Cloud Computing & Cloud Architecture Challenge.
Today, we enter the world of Cloud Security and AWS Identity and Access Management (IAM) — where we learn how to protect our cloud applications by controlling access.
🏫 1. Meet Our College's Digital Security Team
Think about a real college campus.
Not everyone can enter every room.
- 👨🎓 Students can enter classrooms and view their own results.
- 👩🏫 Teachers can manage their classes and submit marks.
- 🧑💻 Developers can maintain the application.
- 👨💼 Administrators can manage important college operations.
Would you give every student the key to the principal's office?
Of course not!
The same principle applies to cloud computing.
In AWS, we must control who can access a resource, which actions they can perform, and which resources they can access.
That's where IAM comes in.
🔑 2. What Is AWS IAM?
AWS Identity and Access Management (IAM) helps you securely control access to AWS resources.
IAM helps answer three important questions:
- WHO? Who is making the request?
- WHAT? What action are they trying to perform?
- WHERE? Which AWS resource are they trying to access?
For example:
Rahul wants to view his exam result.
The college portal should allow him to view his own result, but it should not give him permission to modify the database or access another student's private information.
That's the idea behind access control!
Think of IAM as the security office of our cloud campus. 🛡️
🧩 3. Meet the Four Main Characters of IAM
Let's understand IAM using our college portal.
👤 Character 1: IAM User — A Named Identity
An IAM user represents an identity in AWS that can have its own credentials and permissions.
For example, a college employee responsible for managing AWS resources might have an IAM user.
But remember: IAM users are not the same as students using the college website.
Students usually sign in through the application's own authentication system. IAM is primarily used to control access to AWS itself.
👥 Character 2: IAM Group — A Team With Shared Permissions
Imagine the college has ten developers.
Instead of assigning the same permissions individually to every developer, you can organize IAM users into a group and attach appropriate permissions to that group.
For example:
- Developer group → permissions needed for development tasks.
- Operations group → permissions needed for approved operational tasks.
- Audit group → permissions needed to review specific information.
Groups help organize permissions, but membership should still be carefully managed.
📜 Character 3: IAM Policy — The Rulebook
An IAM policy defines permissions.
It specifies which actions are allowed or denied on which resources, sometimes with additional conditions.
Imagine a college rule:
“Teachers may view the attendance records of their assigned classes but cannot change student fee records.”
An IAM policy expresses access rules in a structured format that AWS can evaluate.
Here's a simplified example of an AWS IAM policy:
1
2
3
4
5
6
7
8
9
10
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:ListBucket",
"Resource": "arn:aws:s3:::college-study-materials"
}
]
}What does this policy do?
"Effect": "Allow"means the statement grants permission."Action": "s3:ListBucket"allows the specified action of listing a bucket's contents."Resource"identifies the particular S3 bucket.
This example grants permission to list the specified bucket. It does not automatically grant permission to download, upload, or delete its objects.
Also, a policy granting access doesn't guarantee that every request will succeed: AWS evaluates the full set of applicable permissions and restrictions.
🎭 Character 4: IAM Role — Temporary Access for a Job
Now imagine our college application runs on an Amazon EC2 virtual machine.
The application needs to read approved study materials from Amazon S3.
Should we save a permanent AWS access key and secret key directly inside the application code?
❌ That's a dangerous approach.
Instead, we can create an IAM role with the necessary permissions and allow the EC2 instance to use that role through an instance profile.
AWS can provide temporary credentials to the application through the role.
The application can then access permitted AWS resources without storing long-term access keys in its code.
Think of an IAM role as a temporary security badge issued to an approved worker for a specific job.
Important: A role doesn't automatically make an application secure. Its trust policy, permissions, and use must all be configured correctly.
🏗️ 4. Let's Secure Our College Portal Architecture
Remember the architecture we built in Day 10?
Our portal uses networking components to direct traffic to the application.
Now we add another layer: access control.
Here's our evolving architecture:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
👨🎓 Students
|
v
Internet
|
v
Load Balancer
|
v
+-------------------+
| Amazon EC2 |
| Application Server|
+-------------------+
|
IAM Role for EC2
|
v
Amazon S3
Student Study Materials
Application
|
v
Amazon RDS
Student RecordsLet's understand the security responsibilities.
- Load balancer and VPC security controls: Help control how network traffic reaches the application.
- Application authentication and authorization: Determine which student or employee can use particular application features and access particular records.
- IAM role for EC2: Gives the application server approved permissions to interact with AWS services.
- Amazon S3 permissions: Control which S3 actions the application can perform on specified resources.
- Database credentials and database permissions: Control how the application connects to the database and which database operations it can perform.
Notice something important?
Network security and IAM solve different problems.
A security group controls network traffic. IAM controls access to AWS actions and resources. Your application and database also need their own appropriate access controls.
A secure cloud architecture uses these protections together. 🛡️
🚫 5. The Golden Rule: Least Privilege
Let's imagine we hire a new developer to improve the college portal.
The developer only needs to view application logs to investigate an error.
Would you grant permission to delete every database, modify all IAM policies, and shut down every server?
Absolutely not!
The developer should receive only the permissions required for the assigned task.
This principle is called the Principle of Least Privilege.
In simple words:
Give every identity only the access it needs — nothing more.
Here are some examples:
| Identity | Appropriate access example |
|---|---|
| Student | View their own results through the portal |
| Developer | Access approved development resources |
| Application server | Read specified S3 objects needed by the application |
| Database administrator | Perform authorized database administration |
| Auditor | Review permitted logs and configuration information |
These are conceptual examples, not universal permission templates. Actual permissions depend on the job, environment, and resource requirements.
Least privilege helps reduce the damage caused by mistakes, compromised credentials, and unauthorized actions.
🔥 6. Three Cloud Security Mistakes to Avoid
Mistake 1: Using the Root User for Everyday Work
The AWS account root user has extensive privileges.
Use it only for tasks that specifically require root-user access, protect its credentials carefully, and enable multi-factor authentication (MFA).
For routine work, use appropriately permissioned identities and roles.
Mistake 2: Giving Everyone Administrator Access
An administrator permission set is not a shortcut to convenience — it can create a much larger security risk.
Grant access according to actual responsibilities, and review permissions regularly.
Mistake 3: Storing AWS Access Keys in Application Code
Never hard-code long-term AWS credentials into source code or commit them to a repository.
For applications running on AWS compute services, use IAM roles and temporary credentials where supported.
Also protect credentials used by people, enable MFA where appropriate, and rotate or revoke exposed credentials promptly.
🕵️ 7. Authentication vs Authorization: Can You Spot the Difference?
These two terms sound similar, but they answer different questions.
Authentication = Who are you?
For example, Rahul signs in to the college portal using his approved login method.
Authorization = What are you allowed to do?
After signing in, Rahul can view his own examination details, but he cannot access the administrator dashboard.
Here's an easy way to remember:
🔐 Authentication checks your identity.
🚪 Authorization checks your permissions.
Both are essential for a secure application.
In a real system, authentication might be handled by the college application's identity provider, while application authorization enforces which records and actions each user can access. AWS IAM separately governs access to AWS resources and operations.
🎯 8. Mini Challenge: Become the Cloud Security Architect!
Our college portal has three new requirements.
Challenge A: The EC2 application server needs to read examination documents from one specific S3 bucket.
Which is the better choice?
A. Give the EC2 instance administrator access to the entire AWS account.
B. Assign an IAM role with only the required S3 permissions.
C. Store an administrator's access keys inside the source code.
Challenge B: A developer needs to investigate an application error by viewing approved logs.
What should you do?
A. Grant unrestricted access to every AWS service.
B. Provide the minimum permissions needed to access the relevant logs.
C. Share the root user's credentials.
Challenge C: Rahul has successfully signed in, but tries to view another student's private examination result.
What should prevent this?
A. Authentication alone.
B. Application-level authorization that checks whether Rahul is allowed to access that record.
C. A larger EC2 instance.
✅ Answers
- Challenge A: B — An appropriately scoped IAM role provides the application with the permissions it needs.
- Challenge B: B — Least privilege limits unnecessary access.
- Challenge C: B — The application must enforce authorization for individual records.
If you got all three right, congratulations! 🎉 You're beginning to think like a cloud security architect.
🧠 9. The Big Picture: Security Is More Than One Service
Let's connect our journey so far.
- Day 5: We learned where AWS applications live through Regions and Availability Zones.
- Day 6: We explored how applications can withstand failures.
- Day 7: We discovered virtual machines and Amazon EC2.
- Day 8: We learned how object, block, and file storage work.
- Day 9: We explored cloud databases.
- Day 10: We connected the architecture using cloud networking.
- Day 11: We added identity, permissions, and access control.
Our architecture is becoming more complete, but no single AWS service guarantees security by itself.
A strong design combines identity and access management, network controls, secure application logic, database permissions, encryption, logging, monitoring, and ongoing review.
Security is not a final checkbox. It is a responsibility built into every layer of the architecture.
🏆 Mission Complete!
Today, we learned that building a cloud application isn't just about making it run.
We must also make sure that the right people and applications can access the right resources — and that everyone else is blocked.
IAM helps us manage access to AWS resources. Application authorization protects application features and user data. Network security controls how traffic reaches our systems.
Together, these layers help protect our college examination portal.
🚀 Coming Up on Day 12/30
Load Balancing — How Does One Application Handle Thousands of Users?
Imagine thousands of students rushing to register for examinations at the exact same moment.
Will one application server handle all those requests?
What happens if that server becomes overloaded?
And how can AWS distribute traffic across multiple servers?
On Day 12, we'll explore load balancing and discover how to keep our application responsive as demand grows.
Until then, remember:
☁️ Build smart. Design securely. Give only the access that's needed.
#CloudComputing #AWS #CloudSecurity #AWSIAM #CloudArchitecture #30DaysOfCloud
Series: Cloud Computing (24 articles)
- …
- 12🔐 Day 11/30: Cloud Security & IAM — Who Can Access What in AWS? ☁️ This article
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article