IAM is an AWS service that helps you securely control access to AWS resources.

👉 In simple words:
Who can access AWS + What they can do

Core IAM Components

1️⃣ IAM Users

• Represents a person or application

• Has login credentials

• Example: bipul-admin, jenkins-user

2️⃣ IAM Groups

• Collection of users

• Permissions assigned once to the group

• Example: DevOps-Team, ReadOnly-Users

3️⃣ IAM Policies

• JSON documents that define permissions

• Example:

Copy

Copy

{
  "Effect": "Allow",
  "Action": "s3:ListBucket",
  "Resource": "*"
}

IAM Best Practices (Interview + Real Work)

✔ Never use root user
✔ Enable MFA
✔ Follow Least Privilege
✔ Use Roles instead of access keys
✔ Rotate credentials regularly

Hands-on Task (Do This Today)

1. Login to AWS Console

   

2. Go to IAM

   

3. Create:

   • One IAM User (test-user-221)

     

     

     

     

   • One IAM Group (bipul-cloud-admin):-

     Click on User groups

     

     Created User Groups :- Note no default policy added.

• Attach AmazonS3ReadOnlyAccess:-

• Click on users(bipul-cloud-admin) , then goto Permission, and click Add permission:-

  

  Search for AmazonS3ReadOnlyAccess and select.

  

  

4. Add the user to the group

   Before adding user to group

   

   After adding user to group

AWS IAM Deep Dive: Users, Groups, Roles, and Policies

Identity and Access Management (IAM) is the security backbone of AWS. Every action in AWS is evaluated through IAM before it is allowed or denied. Understanding IAM deeply is critical for Cloud, DevOps, and SRE roles.

1. IAM Users

What is an IAM User?

An IAM User represents a human or application identity that interacts with AWS.

Key Characteristics

• Has long-term credentials (password or access keys)

• Can access AWS Console, CLI, or API

• Permissions are assigned directly or via groups

When to Use IAM Users

• Individual engineers accessing AWS

• Third-party tools needing limited access (temporary use)

Best Practices

• ❌ Avoid attaching policies directly to users

• ✅ Use Groups for permission management

• ✅ Enable MFA for console access.

2. IAM Groups

What is an IAM Group?

A Group is a collection of IAM Users. Permissions are assigned to the group and inherited by all users inside it.

Why Groups Matter

• Simplifies permission management

• Ensures consistency across users

• Easy onboarding/offboarding

Example Use Case

• DevOps-Team → EC2, S3, CloudWatch access

• ReadOnly-Team → View-only access

Real-World Tip

When a user changes roles (e.g., Dev → SRE), you simply change their group membership.

3. IAM Policies (MOST IMPORTANT)

What is an IAM Policy?

A policy is a JSON document that defines permissions.

Policy Structure

Copy

Copy

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::my-bucket/*"
}
]
}

Key Elements Explained

• Effect: Allow or Deny

• Action: What API calls are allowed/denied

• Resource: On which AWS resource

• Condition (optional): Extra security rules

Types of Policies

1. AWS Managed Policies – Created by AWS

2. Customer Managed Policies – Created by you (recommended)

3. Inline Policies – Attached to a single identity (avoid)

Best Practice

✅ Use Customer Managed Policies for better control and reuse

4. IAM Roles (CRITICAL FOR DEVOPS & SRE)

What is an IAM Role?

A Role is an IAM identity assumed temporarily by AWS services or users.

Key Differences: User vs Role

Common Role Use Cases

• EC2 accessing S3

• Lambda writing logs to CloudWatch

• Jenkins deploying to AWS

• Cross-account access

Example: EC2 Accessing S3

• Create IAM Role

• Attach S3 policy

• Attach role to EC2

• EC2 accesses S3 without credentials

5. IAM Permission Evaluation Logic

When a request is made:

1. AWS checks explicit DENY ❌ (highest priority)

2. Then checks explicit ALLOW ✅

3. If nothing matches → Implicit DENY

⚠️ One DENY overrides multiple ALLOWs.

6. IAM Best Practices Summary

✔ Use Roles instead of access keys ✔ Follow least privilege principle ✔ Enable MFA ✔ Use Groups for users ✔ Rotate credentials ✔ Audit with IAM Access Analyzer

7. Real-World DevOps Mapping

• EC2 + S3 → IAM Role

• Jenkins CI/CD → IAM Role + Policy

• Kubernetes (EKS) → IAM Role for Service Accounts

• Monitoring → Read-only IAM policies.