2.2
IAM (users, groups, roles, policies)
Control who can access AWS resources using identities, collective permissions, assumable roles, and JSON policies.
Key points
- Users = persistent identities with permissions.
- Groups = assign permissions to many users.
- Roles = temporary credentials; assumed by users, apps, or services.
- Policies define permissions; MFA adds a second factor.
IAM
IAM stands for Identity and Access Management. IAM controls access to AWS resources.
- Users
- Groups
- Roles
- Policies
- MFA
IAM User
An IAM User is an identity that can access AWS resources according to its permissions.
IAM Group
An IAM Group allows permissions to be assigned collectively to multiple users.
IAM Role
An IAM Role can provide temporary permissions to users, applications, or AWS services.
- Allowing EC2 to access another AWS service
- Allowing Lambda to access S3
- Cross-account access
- Federated access
Exam trap
IAM Role ≠ IAM User — roles are generally assumed and can provide temporary credentials.
Exam focus
IAM Role ≠ IAM User — roles provide temporary credentials.