Swapna Aware's Blog
AWS IAM Explained: How to Secure and Manage Access in AWS

AWS IAM Explained: How to Secure and Manage Access in AWS

Swapna Aware's photo
Swapna Aware
·

6 min read

AWS Identity and Access Management (IAM) is a web service that helps you securely control access to AWS resources. It enables you to manage permissions and define who or what (users, services, applications) can access specific resources, ensuring security and compliance across your AWS environment.

Key Features of AWS IAM

Key FeatureDescriptionExample

Centralized Access Control

Allows you to manage permissions and control access to AWS services and resources from a single place.

Manage which users have access to EC2, S3, or other AWS services via the IAM dashboard.

Fine-Grained Permissions

Grants users the least privilege needed to perform their tasks by defining specific actions they can take.

Create a policy allowing a user to only read objects from a specific S3 bucket but not delete or write to it.

Multi-Factor Authentication

Adds an extra layer of security by requiring a second factor (e.g., a code from a mobile device) to log in.

A developer logging into the AWS Console must provide a password and a code generated by the Google Authenticator app.

Roles for AWS Services

Allows AWS services (like EC2 or Lambda) to access other AWS services securely.

Attach an IAM role to an EC2 instance that allows it to read from an S3 bucket without needing credentials in the instance.

Identity Federation

Enables users to sign into AWS using existing credentials from an external identity provider.

A corporate user logs into AWS using their company’s Active Directory credentials via SAML integration.

IAM Policies

JSON documents that specify permissions and can be attached to users, groups, or roles.

Create a policy that allows users to launch EC2 instances but prevents them from terminating any instances.

Groups

Organize users into groups to manage permissions collectively.

Add all developers to a "Developers" group that grants access to AWS Lambda and S3 for application development.

IAM Access Analyzer

Helps identify resources that are shared with external entities and ensures that policies meet security best practices.

Use Access Analyzer to monitor which S3 buckets are publicly accessible and review unintended sharing.

Permissions Boundaries

Limits the maximum permissions that an IAM entity (user or role) can have.

Set a boundary so a user can create EC2 instances but cannot assign roles with higher privileges than what the boundary allows.

Cross-Account Access

Enables users in one AWS account to access resources in another AWS account.

An IAM role in Account A is allowed to access an S3 bucket in Account B for sharing data between departments.

AWS CloudTrail Integration

Monitors and records IAM activity for auditing and compliance purposes.

CloudTrail logs show when an administrator created a new user and attached the AdministratorAccess policy to the user.

Common IAM Components

  1. Users: Individual accounts that represent people or applications needing access to AWS.

  2. Groups: A collection of IAM users. Permissions assigned to a group apply to all its users.

  3. Roles: Assigned to AWS services or applications to allow them to perform actions on resources.

  4. Policies: JSON documents that define permissions. Policies can be attached to users, groups, and roles.

Step-by-Step Guide to Setting Up AWS IAM

Step 1: Access the IAM Console

  1. Sign in to the AWS Management Console.

  2. Navigate to IAM from the AWS services menu.

Step 2: Create a New IAM User

  1. In the IAM Dashboard, click on Users in the left-hand panel.

  2. Click Add User.

  3. Enter a unique username for the user.

  4. Choose Access Type:

    • Select Programmatic access if the user needs access to AWS CLI or API.

    • Select AWS Management Console access if the user will log in via the AWS Console.

Step 3: Attach Permissions to the User

  1. On the permissions page, choose how you want to assign permissions to the user:

    • Add user to group: Assign the user to a group with predefined permissions.

    • Attach policies directly: Attach predefined policies directly to the user, such as AdministratorAccess, PowerUserAccess, or a custom policy.

    • Copy permissions from an existing user: Copy permissions from another user.

Step 4: Review and Create User

  1. Review the configuration and click Create User.

  2. Once the user is created, download the user’s access key ID and secret access key (for programmatic access). You can also send login instructions via email if the user will use the console.

Step 5: Set Up Multi-Factor Authentication (MFA)

  1. In the IAM dashboard, select the user you want to enable MFA for.

  2. In the Security Credentials tab, click Manage MFA.

  3. Choose your MFA device:

    • Virtual MFA device (e.g., Google Authenticator).

    • Hardware MFA device.

  4. Follow the steps to configure MFA and associate it with the user.

Step 6: Create and Assign Roles

  1. In the IAM dashboard, click on Roles.

  2. Click Create Role.

  3. Choose the type of trusted entity that will assume the role:

    • AWS Service (e.g., EC2, Lambda).

    • Another AWS Account.

  4. Select the permissions policies to attach to the role.

  5. Give the role a name and create it.

  6. Attach the role to a service (e.g., EC2) by going to the service in the AWS Console, selecting the role, and applying it.

Step 7: Create and Manage Policies

  1. In the IAM dashboard, click on Policies.

  2. Click Create Policy.

  3. Choose a Service (e.g., EC2, S3) and define the actions (e.g., Read, Write) that you want to allow or deny.

  4. Use the Policy Editor to create a custom JSON policy.

     jsonCopy code{
   "Version": "2012-10-17",
   "Statement": [
     {
       "Effect": "Allow",
       "Action": "s3:ListBucket",
       "Resource": "arn:aws:s3:::example-bucket"
     }
   ]
 }

  5. Review and attach the policy to users, groups, or roles as needed.

Best Practices for Using AWS IAM

  1. Use the Principle of Least Privilege:

    • Grant users only the permissions they need to perform their tasks. Avoid giving excessive permissions, such as full admin access unless required.

  2. Enable MFA for All Users:

    • Enforce the use of multi-factor authentication (MFA) to enhance account security.

  3. Use IAM Roles for Services:

    • Assign IAM roles to AWS services like EC2, Lambda, or ECS to securely interact with other AWS resources (such as reading data from S3).

  4. Rotate Credentials Regularly:

    • Regularly rotate access keys and passwords to prevent security risks. You can automate this with IAM access analyzer.

  5. Monitor and Audit IAM Activity:

    • Use AWS CloudTrail to track IAM activities, such as user logins, API calls, and changes to IAM resources, for auditing and security purposes.

  6. Group Users Based on Roles:

    • Organize users into groups (e.g., DevOps, Developers, Administrators) and assign group-level permissions. This makes managing large teams easier.

  7. Use IAM Policies and Boundaries:

    • Use permission boundaries to limit the maximum permissions an IAM role or user can have. This helps in preventing escalation of privileges.

Conclusion

AWS IAM is a powerful tool for managing access to AWS resources. By using features like fine-grained permissions, MFA, roles, and policies, you can secure and maintain compliance in your cloud environment. Proper setup enables you to enforce least privilege, monitor activities, and protect your resources efficiently.