Advanced 30 min read Module 7 of 8

AWS Security & IAM

Learn how to keep your AWS account safe. IAM, Roles, Policies, and security best practices.

What is IAM?

IAM (Identity and Access Management) is AWS's security service. It controls who can access your AWS resources and what they can do.

Users
Individual people

Groups
Collections of users

Roles
For services and EC2

IAM Users and Groups

Users
  • Individual people accessing AWS
  • Each has unique credentials
  • Can have password and access keys
  • Never share credentials!
Groups
  • Collection of users with same permissions
  • Example: Admins, Developers, ReadOnly
  • Attach policies to groups
  • Users inherit group permissions
Best Practice: Use groups to manage permissions. Add users to groups, not individual policies.

IAM Roles

Roles are for AWS services that need permissions. Instead of giving users access keys, you give services permissions through roles.

EC2 Roles
Give EC2 access to S3, RDS, etc.

Lambda Roles
Give functions permissions

Cross-Account
Access resources in another account

Remember: Never store AWS credentials in your code! Use IAM Roles instead.

IAM Policies

Policies are JSON documents that define what actions are allowed or denied. 

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::my-bucket/*"
        }
    ]
}
Allow Deny Action Resource

Security Best Practices

Enable MFA for all users
Rotate keys regularly (every 90 days)
Use roles instead of access keys
Enable CloudTrail for auditing
Follow least privilege principle
Set up billing alarms for $1

Exercise: Create an IAM User

Task: Create an IAM user with limited permissions.

  1. Go to IAM → Users → Add user
  2. Name: developer
  3. Select "Programmatic access" and "AWS Management Console access"
  4. Create a group called dev-group with EC2 and S3 read-only
  5. Add the user to the group
  6. Save the access key and secret key
  7. Test the user by logging in
Show Solution 
# Using AWS CLI to create a user
aws iam create-user --user-name developer

# Create access key
aws iam create-access-key --user-name developer

# Attach policy for S3 read-only
aws iam attach-user-policy --user-name developer --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
Key Takeaway

IAM is the foundation of AWS security. Use groups for managing users, roles for services, and policies for fine-grained permissions. Always follow the principle of least privilege!

Previous: Databases Next: Deployment
Modules