AWS IAM mindmap

AWS Identity and Access Management

Control who is authenticated and authorized to use AWS resources

• Identities
  • Root user: Full access to the account; protect with MFA and use only for the few tasks that need it
  • IAM users: Long-term credentials; prefer federation and roles instead
  • IAM groups: Attach policies to many users at once; groups cannot be principals
  • IAM roles: Assumed for temporary credentials through AWS STS
  • Service-linked roles: Predefined roles that an AWS service uses on your behalf
• Policy types
  • Identity-based policies: Attached to users, groups and roles; AWS managed, customer managed or inline
  • Resource-based policies: Attached to resources such as S3 buckets and KMS keys; name a principal
  • Permissions boundaries: The maximum permissions an identity-based policy can grant
  • Service control policies (SCPs): Maximum permissions for principals in member accounts
  • Resource control policies (RCPs): Maximum permissions for resources in member accounts
  • Session policies: Passed when assuming a role to limit that session
  • Trust policies: The resource-based policy on a role that says who can assume it
• Policy evaluation
  • Default deny: Every request is denied unless something allows it
  • Explicit deny wins: A Deny in any applicable policy overrides every Allow
  • Guardrails must allow: SCPs, RCPs, boundaries and session policies must allow the action too
  • Cross-account access: Both the identity policy and the resource policy (or role trust) must allow it
• Policy language
  • Effect, Action, Resource: The core elements of a statement
  • Principal: Who the resource-based policy applies to
  • Condition: Keys such as aws:SourceIp, aws:PrincipalOrgID, aws:MultiFactorAuthPresent
  • ABAC: Attribute-based access control with tags (aws:PrincipalTag, aws:ResourceTag)
• Federation
  • IAM Identity Center: Recommended for workforce access across accounts
  • SAML 2.0: Federate a corporate identity provider to IAM roles
  • OpenID Connect: Web identity federation, for example CI/CD pipelines assuming roles
• Tools
  • IAM Access Analyzer: External access, unused access, policy validation and policy generation
  • Last accessed information: Find unused services and actions to remove
  • Policy simulator: Test what a set of policies allows
  • Credential report: Account-wide list of users and credential status
• Best practices
  • Use temporary credentials: Federation for people, roles for workloads
  • Require MFA: Especially for the root user and privileged access
  • Grant least privilege: Start from AWS managed policies, then narrow with Access Analyzer
  • Rotate or remove long-term keys: Remove unused users, roles, permissions and keys