What is IAM? — AWS Identity and Access Management

Understanding the Basics of AWS IAM with Best Practices

If you are new to Cloud computing, It can be hard to understand all the different aspects of cloud computing and how they work together. My suggestion is to start with a single step. That is IAM.

What do you think when I say IAM? In the real world, you use “I am” to express who you are. What are you doing, and what are your abilities and weaknesses like that? Yeah, that is the same as in AWS. AWS IAM is one of the key components of cloud security. IAM stands for Identity and Access Management. It is used to identify you and find the abilities and disabilities you currently have. I think it is the same as the real world. Also, you will agree with me. Any way If you are not familiar with this. I am pretty sure you will be confused. However, understanding IAM is crucial for ensuring the security of your cloud-based infrastructure.

In this blog post, I will provide a brief introduction to AWS IAM. Especially, if you are new to the cloud, I will explain what AWS IAM is, how it works, and why it is important. Also, you will be able to learn some best practices related to the IAM as well. At the end of this post, you will have a good understanding of IAM and be able to manage your resources more securely

What is IAM?

• Permission system that regulates access to AWS resources — It helps you as the administrator defined who can access what resource on an AWS account.

• Allows you to assign permissions to a group of users — IAM users allow you to assign broad or specific permissions could include things like providing access to entire AWS services such as DynamoDB. Whereas specific permissions could include fine-grain access to a particular S# bucket to perform read and write operations.

• IAM provides a mechanism to monitor and audit access to specific resources by enabling AWS CloudTrail.

• Integrates with other Identity Tech( Microsoft ActiveDirectory) — you are in a large organization with existing identity technologies, you will be pleased to know that AWS IAM can easily integrate with them.

That is the high-level overview of what IAM is so let’s get an idea about how it works.

How IAM Works

There are four main key concepts that you need to be aware of when using IAM those are Users, Groups, Roles, and Policies/Permissions. Let’s discuss one by One

1. Users — Specific Individuals, can receive personal logins

Users refer to specific individuals, and using IAM, you can grant each user a login and password so they can access the AWS console on their own. Although they’ll have a limited set of permissions that you define, Also, they have secret keys and secret access keys. which are used as inputs when setting up clients in your application-level code.

2. Groups — Collection of users

Then there are groups, which simply refer to a collection of users with a common theme or set of permissions. An example could be intern students and senior developers. We want intern students to have a very different set of permissions than senior developers.

3. Roles — Collection of policies

There are roles in AWS IAM. You can define a role, for example, as a collection of policies. That has both read and write permissions to a specific AWS DynamoDB table. Roles are typically not directly tied to individual users and are meant to be assumed by anyone who needs them, for instance. You can use roles to allow users within a different AWS account to access one of your DynamoDB tables by creating a role with the right permissions and then granting them the ability to assume or use that role.

4. Policies — Low-level permission to resources

There are policies, which are the bread and butter of IAM. These things define the specific low-level permissions for access to AWS resources. And there are two variations to these: allow or deny, so you can allow or deny permissions to resources.

So here’s an example of what a policy looks like in JSON format. So, if we take a look at this a little closer, we have a version of a statement, and this is really where the meat of the policy is. We have a SID, which stands for statement ID. This can be anything. We have an effect, and that is allowed in this case, so that can either allow or deny. We have action, and these are the specific permissions that we want to permit, so we have a dynamo to be scan and a dynamo DB query. So, these two permissions are what is allowed with this policy. We also have another factor here, which is resources, and in this example, we are providing a specific AWS resource. So this policy or this permission only provides users with these scan and query operations on this specific table. Now, optionally, you can put a wild card in here, which is a star (*), and this would give the user that is using this policy access to all DynamoDB tables.

How IAM Works — Example

Let’s move on now to a practical example. How an organization may set up IAM So, in this example, we’re working with one group of intern students, and we have three users. They’ve defined John, Mary, and Steven. Now Mary and Steven are intern students, so, like I was alluding to before, I want to give them fewer or more restrictive permissions than other users.

We have two policies now. Those are DynamoDBBasicWrite and DynamoDBBasicRead. DynamoDBBasicWrite gives the ability to perform a put item operation on a specific table. DynamoDBBasicRead gives the query and gets item permissions on this table, too. So in this example, we want to associate this intern student group with DynamoDB to have basic read permissions to give Mary and Steven access to this DynamoDB table, and that’s very simple to do in the AWS console. You just go to the group section and add a policy, and then select this policy that has the permissions that you need now.

What about John, who’s left all alone now that John wants to access this table as well? He wants to access the put item and the query and get item APIs. So, how can we do this? Well, we can create a DynamoDBReadWrite role, and with that role, we can associate these two policies with it. So now anyone who is using this role will have access to these resources. and these specific API endpoints, so when we go to the user section for John, we can grant him this dynamoDB role in doing so, giving him access to this table for the put item and the query and get item APIs. So that’s a pretty simple example of how you may set this up in an organization; now hopefully that made sense.

Best Practices

So let’s move on to best practices when using IAM. By applying the following best practices, you can improve your IAM strategies and reduce the risk of data breaches and other security incidents.

1. Principle of Least Privilege: This principle involves granting the minimum necessary privileges to users, applications, and services to perform their job functions. This ensures that users only have access to the resources they need and prevents unnecessary exposure of sensitive data.

2. Strong Authentication: The use of strong authentication mechanisms such as multi-factor authentication (MFA) or biometric authentication can help prevent unauthorized access to sensitive information.

3. Role-based Access Control: Implementing role-based access control (RBAC) helps to ensure that users only have access to the resources they need to perform their specific job functions.

4. Regular Auditing: Regular auditing and reviewing access logs can help organizations identify any unauthorized access attempts or policy violations.

5. Separation of Duties: Separating duties between different users or groups can help prevent conflicts of interest and reduce the risk of fraud or errors.

6. Continuous Monitoring: Implementing continuous monitoring mechanisms can help organizations quickly identify and respond to security incidents, such as attempts to access sensitive data or changes to access policies.

7. Automation: Automating IAM processes such as user provisioning, access requests, and de-provisioning can help improve efficiency, reduce errors, and ensure compliance with policies and regulations.

Conclusion

Finally, now you have a good understanding of what AWS IAM is, how it works, and the best practices. Applying this knowledge, you will be able to manage your cloud-based infrastructure securely.

Originally Published at https://medium.com/enlear-academy/what-is-iam-aws-identity-and-access-management-bcba8092f465 on 13 Apr 2023