Complete Guide to AWS IAM: Secure Access Management for the Cloud#

Amazon Identity and Access Management (IAM) enables you to manage access to AWS services and resources securely. Using IAM, you can create and manage AWS users and groups, and use permissions to allow and deny their access to AWS resources.

🛑 CAUTION: Be careful when granting permissions. Overly permissive policies can pose a security risk. Always follow the principle of least privilege.

Key Concepts#

1. Users#

1
- Represents a person or a Service that Interact with AWS
2
- Each user has a unique set of Security Credentials

2. Groups#

1
- Collections of IAM users.
2
- Groups only contain users, not other groups
3
- Users in groups inherit the permissions assigned to the group.

3. Roles#

1
- A set of permissions defining what actions are allowed and denied by an entity in AWS.
2
- Roles can be assumed by users, applications, or services.

Deep Dive on IAM Roles

4. Policies#

1
- Documents defining permissions and are associated with users, groups, or roles.
2
- Written in JSON and specify what actions are allowed or denied on which resources.
3

4
-Example:
5
    ```
6
        {
7
            "Version" : "2012-10-17",  #Start with this date
8
            "id"       : " ",
9
            "Statement" :
10
            [
11
                    "Sid"      : " ",
12
                    "Effect"   : " ",
13
                    "Principal": " ",
14
                    "Action"   : " ",
15
                    "Resources": " ",
16
                    "Condition": " "
17

18
            ]
19

20
        }
21
    ```

5. Permissions#

1
- It's Basically a Json Document called policies that can be assigned to Users Or groups
2

3
- Define what actions a user or service can perform.
4
- Managed via policies.

6. Multi-Factor Authentication (MFA)#

Provides an extra layer of security by requiring a second form of authentication.
Use Google Authenticator or TOTP

7. Access Keys#

Used for programmatic access (CDK/SDK) to AWS services.
Consist of an Access Key ID and Secret Access Key.

8. IAM Best Practices#

Enable MFA for privileged users.
Use roles for applications that run on EC2 instances.
Rotate credentials regularly.
Grant least privilege: only the permissions needed to perform a task.

IAM Password Policy#

⚠️ CAUTION: Ensuring a strong password policy is critical for maintaining security.

Overview#

IAM Password Policies allow you to enforce specific password requirements for your AWS users. This helps ensure that passwords meet your organization’s security standards.

Key Settings#

Minimum Password Length: Specify the minimum number of characters a password must have.
Require Numbers: Enforce the inclusion of at least one numeric character.
Require Symbols: Enforce the inclusion of at least one special character (e.g., !, @, #).
Require Uppercase Letters: Enforce the inclusion of at least one uppercase letter.
Require Lowercase Letters: Enforce the inclusion of at least one lowercase letter.
Allow Users to Change Their Own Password: Permit users to change their passwords.
Password Expiration: Set a duration after which passwords must be changed.
Prevent Password Reuse: Restrict the reuse of previous passwords.

Example Policy JSON#

1
{
2
    "MinimumPasswordLength": 8,
3
    "RequireSymbols": true,
4
    "RequireNumbers": true,
5
    "RequireUppercaseCharacters": true,
6
    "RequireLowercaseCharacters": true,
7
    "AllowUsersToChangePassword": true,
8
    "ExpirePasswords": true,
9
    "MaxPasswordAge": 90,
10
    "PasswordReusePrevention": 5,
11
    "HardExpiry": false
12
}

Newsletter