AWS IAM

What it is

AWS IAM (Identity and Access Management) is AWS's central authentication and authorization service that controls who can access which resources and under what conditions. It defines identities (users, roles, groups), permission policies, and authentication mechanisms for every interaction with the AWS API.

IAM operates under a "deny by default" model — everything is prohibited until explicitly granted. Every AWS API call passes through IAM's policy evaluation engine, which determines if the action is allowed based on policies attached to the identity and resource.

The service implements the zero trust principle where every request must be authenticated and authorized regardless of origin. This architecture is fundamental for any secure infrastructure as code implementation on AWS.

Core components

Identities

Users: Represent physical people with permanent credentials. In production environments, roles are preferred over users to reduce the attack surface of long-lived credentials.

Roles: Identities that can be temporarily assumed by users, services, or applications. Roles don't have permanent credentials — AWS generates temporary tokens through STS (Security Token Service). They are the recommended practice for services like AWS Lambda.

Groups: Logical collections of users sharing similar permissions. They facilitate permission management at organizational scale.

Policies and permissions

Policies are JSON documents defining permissions using AWS's policy language. They follow the Effect-Action-Resource-Condition structure:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "203.0.113.0/24"
        }
      }
    }
  ]
}

Policy types

Principle of least privilege

Effective least privilege implementation requires an iterative approach:

Implementation strategy

1. Restrictive baseline: Start with no permissions and add based on documented need
2. Continuous monitoring: Use IAM Access Analyzer to identify unused permissions
3. Regular rotation: Implement automatic access key rotation and periodic role review
4. Function segregation: Separate read, write, and administrative permissions

Least privilege policy example

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::app-data-${aws:userid}/*"
    },
    {
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::app-data-${aws:userid}",
      "Condition": {
        "StringLike": {
          "s3:prefix": "${aws:userid}/*"
        }
      }
    }
  ]
}

IAM Access Analyzer

IAM Access Analyzer uses automated reasoning (logic-based reasoning) to identify externally shared resources and generate policies based on actual usage:

• External access findings: Detects resources accessible from outside the account
• Unused access findings: Identifies granted but unused permissions over a configurable tracking period
• Policy generation: Creates least privilege policies based on CloudTrail logs

Integration with policy as code enables automated policy review and updates based on these findings.

Cross-account access patterns

Cross-account roles

For access between AWS accounts, roles are configured with trust policies allowing assumption from specific accounts:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::ACCOUNT-B:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "unique-external-id"
        }
      }
    }
  ]
}

Resource-based policies

Alternatively, resource-based policies allow direct access without role assumption:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::ACCOUNT-B:role/CrossAccountRole"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::shared-bucket/*"
    }
  ]
}

Service-linked roles

Service-linked roles are predefined roles by AWS that grant specific permissions to AWS services to operate in your account. They are created automatically when a service is enabled and cannot be modified:

• Auto-scaling groups: AWSServiceRoleForAutoScaling
• ECS services: AWSServiceRoleForECS
• Lambda@Edge: AWSServiceRoleForLambdaReplicator

These roles implement least privilege at the service level and integrate with secrets management for secure temporary credential handling.

Permission boundaries

Permission boundaries act as maximum privilege filters, defining the upper limit of permissions an identity can have:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "*",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": ["us-east-1", "us-west-2"]
        }
      }
    },
    {
      "Effect": "Deny",
      "Action": [
        "iam:CreateUser",
        "iam:DeleteUser",
        "organizations:*"
      ],
      "Resource": "*"
    }
  ]
}

Why it matters

IAM is the nervous system of AWS security — every API call passes through its evaluation engine. For staff+ engineers, mastering IAM means understanding that security isn't an add-on but the fundamental architecture. IAM design decisions directly impact development velocity, security posture, and operational costs.

The cost of incorrect IAM configuration can be catastrophic: from security breaches to operational lockouts. Policy complexity grows significantly with organization size, making it critical to establish consistent patterns from the start. Investment in IAM automation and proactive governance is directly proportional to infrastructure scale.

References

• IAM User Guide — AWS, 2024. Complete official documentation.
• IAM Best Practices — AWS, 2024. Security best practices.
• IAM Access Analyzer — AWS, 2024. Access analysis and policy generation.
• Security, Identity & Compliance — AWS Architecture Center, 2024. Enterprise security patterns.
• IAM Policy Language Reference — AWS, 2024. Complete policy language reference.
• Cross-Account Access — AWS, 2024. Cross-account access tutorial.
• Service-Linked Roles — AWS, 2024. Service-linked roles guide.