AWS and IAM Basics

AWS Identity and Access Management (IAM) is a web service provided by Amazon Web Services (AWS) that enables you to securely control access to AWS resources. IAM allows you to manage users, groups, and permissions, defining who can access which resources and what actions they can perform. Here are some key concepts and features of IAM:

• IAM is a feature of your AWS account and is offered at no additional charge.
• Access is denied by default and is granted only when permissions specify an "Allow."
• IAM enables you to specify who can access which AWS services and resources, and under which conditions.
• IAM users are identities with unique credentials and permissions that allow them to access AWS resources.
• IAM groups are collections of IAM users. You can assign permissions to a group, and these permissions are automatically applied to all users in the group.
• IAM roles are temporary credentials that can be assumed by IAM users, applications, or services.
• IAM policies are documents that define permissions for IAM users, groups, and roles. They are written in JSON and can be attached to IAM entities.

1. Users:IAM users represent individuals or entities that interact with AWS resources. Each user is associated with security credentials (access key and secret key) for programmatic access or can use AWS Management Console with a username and password.
2. Groups:Groups are collections of IAM users. Instead of attaching policies to individual users, you can assign permissions to groups. This simplifies the management of permissions for multiple users who require the same access level.
3. Roles:IAM roles are similar to users but are not associated with a specific identity. Instead, roles are assumed by users, services, or AWS resources to temporarily receive permissions. Roles are often used to grant permissions to AWS services, such as EC2 instances or Lambda functions.
4. Policies:IAM policies are JSON documents that define permissions. Policies can be attached to users, groups, or roles. AWS provides predefined policies, and you can also create custom policies to meet specific requirements. Policies define what actions are allowed or denied on which resources.
5. Permissions:Permissions in IAM are granted through policies. Policies can grant permissions at the level of an entire service, specific resources, or even specific API actions. IAM uses a least privilege principle, where users, groups, or roles are granted the minimum permissions required to perform their tasks.
6. ARN (Amazon Resource Name):ARNs are Amazon Resource Names that uniquely identify AWS resources. ARNs are used in IAM policies to specify the resources to which permissions are granted.
7. Multi-Factor Authentication (MFA):IAM supports multi-factor authentication, adding an extra layer of security to user accounts. Users can enable MFA devices, such as hardware tokens or virtual MFA apps, to provide an additional authentication factor.
8. IAM Access Analyzer:This tool helps identify resources that can be accessed by or shared with external entities. It helps in understanding and managing resource access across accounts.
9. IAM Roles for Service Accounts (IRSA):IAM roles for service accounts enable AWS services to assume roles and obtain temporary security credentials to access other AWS resources securely. This is commonly used in scenarios where AWS services need to interact with each other.