Micro Series: What is AWS IAM?

AWS IAM (Identity and Access Management) is the AWS service used to control who or what can access AWS resources and what actions they are allowed to perform. The main building blocks are users, groups, roles, policies, and permissions. An IAM User represents a specific person or long-term identity, while a Group is a collection of users that can share the same permissions. An IAM Role is an identity that can be assumed temporarily by users, applications, AWS services, or other AWS accounts. A Policy is a document that defines what actions are allowed or denied on which resources for example, allowing an application to read objects from a specific S3 bucket. In IAM, permissions ultimately come from policies attached to users, groups, or roles.

A useful way to think about IAM is “identity → policy → permission → resource.” For example, rather than giving an application an AWS access key belonging to a developer, you would typically create an IAM Role with a policy allowing the application to read from S3, and then allow the application to assume that role. AWS evaluates the applicable policies whenever an identity tries to access a resource. Explicit Deny overrides Allow, while access is generally denied by default if there is no applicable Allow. IAM therefore provides the foundation for the least-privilege principle: give each user, application, or AWS service only the permissions it actually needs.