IAM

Identity and Access Management (IAM) service enables cloud administrators to define, manage, and audit an AWS user’s level of access to AWS APIs and resources within an account.

Introduction

IAM, which stands for Identity Access Management, is an AWS service used to manage API and web console access to cloud resources.

Overview

When a user attempts to access an AWS resource through the API or web console, an HTTP request is sent to the endpoint for the target AWS service. After verifying the request signature, it is evaluated against all relevant IAM access policies, which dictate the allowed actions for the caller. If there exists at least one rule granting access and no explicit deny rule in any policies or permission boundaries, then the request is granted. Otherwise, it is rejected.

Features

IAM primarily handles all aspects of authentication and authorization when accessing cloud services.¹ Authentication determines the validity of the identity of a user while authorization determines whether a given identity is permitted to perform a given action.

Identity

Identity is an entity that enables access to an AWS account’s cloud resources.¹ IAM provides the following entities for managing identity information:

Users: Represents an entity, typically a human user, that accesses AWS resources or services
Groups: Manages access for a collection of AWS users.
Roles: Temporarily assumed by an identity to perform a given set of actions.

Access

Once the identity of the caller has been established, the next step is to determine whether they are authorized to perform the requested action. To accomplish this, IAM evaluates the identity against all relevant policies, which specifies the allowed and restricted actions for a given user. These IAM policies can be directly assigned to users or groups or through Attribute Access Control (ABAC), which associates a policy with an identity based on the identity’s tags.²

Management

In addition to providing services to define identity information and access, IAM also provides services to ensure best practices are enforced regarding access. Some of this tooling includes analyzing user’s access patterns to refine permissions, identifying unused permissions, and other auditing capabilities.

Non-Features

IAM handles authentication and authorization when accessing resources via the AWS APIs. It is not intended for the following use-cases:

Network Security: IAM does not evaluate non-AWS API traffic to AWS resources, such as network connections to public servers or databases.
Application Identity Management: IAM is not intended to provide identity functionality for third-party applications and services, such as storing user credentials, and handling of login/account-reset flows.

Identities

An IAM identity refers to some entity that provides access to AWS resources. There are several types of identities provided by IAM for this purpose, including users, user groups, and roles. By default, newly created identities have no permissions. These entities must be explicitly assigned permissions to successfully perform API calls, which will be discussed in the following Access section.

Users

IAM users represent a human user or programmatic workload and provides access to AWS resources or services. Users belong to a single parent account and consists of the following properties and credentials:

Access Credentials: Programmatic long-lived credentials consisting of an access key ID and secret key.
Path: The IAM namespace which contains the user.
Login Profile: AWS web console credentials.
MFA Device: MFA devices required for accessing AWS resources, whether through the web console or programmatically.
SSL Certificates: May be used to authenticate with certain AWS services.
SSH Keys: SSH public keys to be used with AWS Codecommit, a git repository service, during application development.

Command

aws iam get-user --user-name $USERNAME

Output

{
    "User": {
        "Path": "/",
        "UserName": "username",
        "UserId": "ADSAYFF72444NEI6MNIOP",
        "Arn": "arn:aws:iam::012345678910:user/username",
        "CreateDate": "2019-07-10T23:13:11+00:00",
        "Tags": [
            {
                "Key": "TagName",
                "Value": "TagValue"
            }
        ]
    }
}

Upon creating a new AWS account, a root user is automatically created, which has complete access to all cloud resources with limited exceptions. For this reason, it is recommended that you create an administrator user for everyday use and restrict access to root user credentials.

There are two possible login flows depending on the type of user attempting to sign in.¹

Root User

To sign in as a root user, simply navigate to the sign-in page, select “Root User”, and enter the root user credentials and optional MFA code.

IAM User

To sign in to the AWS console as a non-root user, you can either use standard sign-in webpage and provide the target AWS account number or specify the account alias in the URL as such: https://<account_id_or_alias>.signin.aws.amazon.com/console/.

https://aws.amazon.com/premiumsupport/knowledge-center/sign-in-console/ ↩︎

Provision Users

To provision an IAM user, the only required property is the username, which is unique within the AWS account.

pulumi up -y

pulumi destroy -y

// iam/identities/users/create_user/ts/index.ts

import * as aws from "@pulumi/aws";

// Create IAM user with long-lived access credentials
const user = new aws.iam.User("techsquawks-user", {
    name: "techsquawks-user"
});

// Export user information
export const userArn = user.arn;
export const userName = user.name;

IAM

Subsections of IAM

Introduction

Overview

Features

Identity

Access

Management

Non-Features

Identities

Subsections of Identity

Users

Users

Console Login Process

Root User

IAM User

Subsections of Users

Provision Users

Paths

Access Credentials

Console Passwords

Groups

Groups

Roles

Roles

Use Cases 3

Use Cases ³