AWS IAM Made Simple: How AWS Controls Access to Your Resources
Learn how AWS IAM manages secure access by understanding the connection between authentication and authorization, and how users, groups, roles, and policies work together to control AWS resource permissions
What is AWS IAM?
AWS IAM is a service that provides authentication and authorization for AWS resources.
In simple words,
- Authentication: Who are you?
- Authorization: What are you allowed to do? For example, imagine a company where an employee wants to access an Amazon S3 bucket.
First, AWS needs to know who the employee is. This is authentication.
After identifying the employee, AWS needs to check what the employee is allowed to do, such as viewing, uploading, or deleting files. This is authorization.
This is where IAM Users, Groups, Roles, and Policies work together.
1. IAM Users — Authentication
An IAM User represents a person or application that needs an identity within an AWS account.
Think of an IAM User as a digital identity.
For example:
- AWS Developer
- AWS Administrator
When a user signs in using their credentials, AWS can verify their identity.
So, for beginners:
IAM Users are mainly connected with authentication — identifying who is trying to access AWS.
2. IAM Policies — Authorization
An IAM Policy is a document that defines what actions an identity is allowed or not allowed to perform on AWS resources.
This is the authorization part of IAM.
For example, a policy could say:
Users can read objects from this S3 bucket.
A policy can define things such as:
- Effect — Allow or Deny
- Action — What operation can be performed
- Resource — Which AWS resource is affected
A simplified example:
1
2
3
Effect: Allow
Action: s3:GetObject
Resource: my-bucket/*This means:
Allow the identity to read objects from the specified S3 bucket.
3. IAM Groups — Managing Permissions for Multiple Users
Imagine a company has 100 developers.
Creating and managing policies individually for every developer would be difficult.
This is where IAM Groups help.
An IAM Group is a collection of IAM Users.
Groups make authorization easier to manage for multiple users.
IAM Roles — Temporary Identity and Access
IAM Roles are another important part of IAM.
A Role provides permissions that can be assumed by a trusted entity, such as an AWS service, user, or application.
This is especially useful when one AWS service needs to access another AWS service.
For example:
Imagine an application running on an EC2 instance needs to read files from an S3 bucket.
Instead of storing AWS access keys inside the application, we can give the EC2 instance an IAM Rol
1
2
3
4
5
6
7
8
9
EC2
|
| assumes
↓
IAM Role
|
| permissions
↓
S3The role can have a policy that allows the required S3 actions.
This follows an important security principle:
Give only the permissions that are required.
This is known as the principle of least privilege
How Everything Connects
Now let's connect all the IAM components to the original definition.
Remember:
IAM = Authentication + Authorization
Authentication — "Who are you?"
IAM identifies the entity trying to access AWS.
Examples include:
- IAM Users
- Federated identities
- Applications/services using IAM Roles
Authorization — "What can you do?"
IAM determines what that identity is allowed to perform.
This is mainly controlled through:
- IAM Policies
- Policies attached to Users
- Policies attached to Groups
- Policies attached to Roles
So we can visualize IAM like this:
1
2
3
4
5
6
7
8
9
10
11
12
AWS IAM
|
---------------------
| |
Authentication Authorization
"Who are you?" "What can you do?"
| |
IAM User IAM Policy
| |
Groups Permissions
| |
Roles Allow / DenyEnjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article