AWS IAM: Complete Guide to Identity and Access Management
IntroductionIn today’s cloud-first world, security is not optional — it’s foundational. AWS IAM (Identity and Access Management) is one of the core services provided by Amazon Web Services that ensures secure access to your cloud infrastructure.
Published Jun 8, 2025
AWS IAM is a service that allows you to securely manage access to AWS services and resources. You can use IAM to create users, groups, roles, and define permissions using policies.
IAM is free and enabled by default in every AWS account.
Here are the main tools that IAM offers to manage access:
- IAM Users – for individual identities
- IAM Groups – to manage permissions across users
- IAM Roles – for temporary access by AWS services or federated users
- IAM Policies – to define fine-grained access
- Multi-Factor Authentication (MFA) – to add an extra security layer
- IAM Access Analyzer – to check for unintended access
- Service Control Policies (SCPs) – for AWS Organizations
- This is the first account created when you sign up for AWS.
- Has full admin access to all services and billing.
- Should be used only for account setup and be protected with MFA.
⚠️ Never use the root user for daily operations. Instead, create IAM users.
- A regular user created under your AWS account.
- Can have console and/or programmatic access (CLI, SDK, API).
- Access is defined via policies.
Example: You create a user
john_dev with permissions only to access EC2.- Users from external identity providers (IdPs) that access AWS via temporary credentials.
- They do not exist in IAM but are mapped to roles via STS (Security Token Service).
Types of federated authentication:
- SSO (Single Sign-On):
- Integrates AWS with Microsoft AD, Google Workspace, Okta, etc.
- Use-case: Company employees log in with their work credentials.
- Social Authentication:
- AWS Cognito allows users to log in using Google, Facebook, or Amazon accounts.
- Used in customer-facing applications.
Example:
A user logs into your app using Google, and Cognito assigns temporary AWS credentials via a federated IAM role.
A user logs into your app using Google, and Cognito assigns temporary AWS credentials via a federated IAM role.
- A collection of IAM users.
- Used to assign the same permissions to multiple users.
- Users inherit the policies attached to the group.
Example: Create a
DevOpsTeam group with access to EC2, S3, and CloudWatch.- IAM Roles provide temporary access to AWS resources.
- Roles are assumed by:
- IAM users
- AWS services (like EC2, Lambda)
- Federated users
- Roles use STS tokens that expire after a set time.
Common roles:
- EC2 instance role to access S3
- Lambda execution role
- Cross-account access role
IAM Policies are JSON documents that define what actions are allowed or denied on which AWS resources.
- Managed Policies
- AWS Managed: Predefined by AWS (e.g.,
AmazonS3ReadOnlyAccess) - Customer Managed: Custom policies that you create and manage.
- Inline Policies
- Policies that are embedded directly into a user, group, or role.
- Used when you want tight coupling between the policy and identity.
Let’s say you’re the admin and need to create access for a new DevOps engineer:
- Create a group called
DevOpsTeam - Attach policies:
AmazonEC2FullAccess,AmazonS3ReadOnlyAccess - Create a user:
shreyash_dev - Add user to group
DevOpsTeam - Enable MFA
- Verify permissions by logging in as
shreyash_dev
- ✅ Enable MFA for all IAM users
- ✅ Avoid root user for daily tasks
- ✅ Use IAM roles for AWS service access
- ✅ Apply least privilege principle
- ✅ Rotate access keys regularly
- ✅ Use IAM Access Analyzer to detect unwanted access
- ✅ Log all access with AWS CloudTrail
Use CaseSolutionEmployees login via work emailAWS SSO with Active DirectoryWeb app users log in via GoogleCognito + IAM Federated RolesDevOps engineer access to EC2IAM User + EC2 PolicyLambda reads from DynamoDBIAM Role for LambdaTemporary access for vendorIAM Role + STS
AWS IAM is essential for building secure cloud architectures. Whether you're just starting out with AWS or managing large-scale environments, understanding IAM will help you control access, improve security, and follow best practices.