AWS IAM Deep-Dive
IAM is not just a checkbox on your AWS setup. It is the foundation of everything secure in your cloud journey. Here is what I learned, broken down the way it finally clicked for me.
What even is IAM?
IAM stands for Identity and Access Management*. It is the AWS service that controls who can access your AWS account and what they are allowed to do inside.*
One of the first things I noted down: IAM is completely free. You pay for the resources you create and use, but the access control layer itself costs nothing. That is a pretty good deal for something this foundational.
Root User vs IAM User
When you first create an AWS account, you get a Root User*. This is the master account. It has full, unrestricted access to everything in your AWS environment.*
Then there is the IAM User*, which is a separate identity you create within your account for day-to-day access.*
The best practice here is clear: avoid using the Root User for regular work. Instead, create IAM Users with only the permissions they need. This principle of least privilege is what keeps your environment secure.
Permissions and Policies
In IAM, everything comes down to this relationship:
A Permission is the raw ability to perform an action, like reading from an S3 bucket or launching an EC2 instance.
A Policy is how those permissions are packaged and attached. You write policies (in JSON format) and attach them to users, groups, or roles to grant or restrict what they can do.
How Do You Actually Access AWS?
There are two main ways to interact with AWS:
- Console Access (GUI) This is the web-based interface at aws.amazon.com. Great for visual exploration, setting things up, or monitoring resources.
- Programmatic Access (CLI / SDK / Dev Tools) This is for when you want to interact with AWS through scripts, automation, or code. It uses the Command Line Interface (CLI) or SDKs built for languages like Python, JavaScript, etc. For programmatic access, you authenticate using an Access Key and a Secret Key. These are credentials you generate in IAM and configure using the aws configure command in the terminal.
- You can have a maximum of 2 sets of keys per IAM user at any given time
- The CLI does not use MFA by default, which is why key management is so critical
MFA: Multi-Factor Authentication
MFA adds an extra layer of security on top of your usual login.
After entering your username and password, you also need to provide a second factor, typically a time-based code from an authenticator app. This applies to both the Root User and IAM Users.
MFA is strongly recommended for both. Especially for the Root User, enabling MFA is one of the very first things you should do after creating your AWS account.
AWS Organizations and the Identity Center
When you are working with multiple AWS accounts (like one for dev, one for test, one for prod), managing users across all of them separately gets messy fast.
This is where AWS Organizations comes in. It lets you group multiple AWS accounts under a single root organization. The structure looks something like this:
AWS Root (Organization)
Root Account (DevOps Team) > Members: EC2, S3
Root Account (Test Team) > Members: Lambda
Root Account (Dev Team) > Members: R53
Now here is where it gets interesting. Instead of creating separate IAM users for every single account in your organization, AWS Identity Center (formerly SSO) lets you manage access centrally.
Key things I noted about Identity Center:
- IAM user creation across multiple accounts is avoided using Identity Center
- With only one single sign-on*, a user can access both the Test and Dev environments*
- Each environment is accessed via a separate URL generated by Identity Center
- Once logged in with Identity Center credentials, you do not need root credentials to access the member accounts
- A user added via Identity Center is called a Federated User
Closing Thoughts
IAM is one of those topics that looks simple on the surface ("just control who logs in") but quickly reveals layers of depth the more you dig in. Getting IAM right from the beginning shapes how secure, scalable, and manageable your entire AWS setup will be. The fact that it is free is just the cherry on top.
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article