📡 You're offline — showing cached content
⚡ New version available!
Quick Access
🗺️ Roadmaps 🃏 Flashcards 📚 Series 🎓 Tutorials 🗺️ My Path 🎤 Mock Interview ⚡ Cheat Code 📄 Resume Builder 🛠️ Dev Tools
Tutorials › AWS Solutions Architect › IAM — Identity and Access Management

IAM — Identity and Access Management

5 min read Quiz at the end
Master IAM Users, Groups, Roles, and Policies. Learn the principle of least privilege that every AWS architect must apply.

IAM — Who Can Do What in AWS

IAM controls who is allowed to access your AWS account and what they are allowed to do. It is the security gatekeeper for everything in AWS.

Teacher Note: Imagine a hotel. The front desk (IAM) gives different key cards to different people. The guest gets a key only for their room. The cleaner gets a key for all rooms but cannot access the vault. The manager gets all keys. IAM works exactly like this.

Core IAM Concepts

ConceptWhat it isExample
UserA person or application with a name and credentialsAlice the developer
GroupA collection of users sharing the same permissionsDevelopers group
RoleTemporary credentials for services or cross-account accessEC2 role to access S3
PolicyA JSON document defining Allow or Deny rulesAllow s3:GetObject on my-bucket
Root AccountThe master account — NEVER use for daily tasksEnable MFA and lock away

The Golden Rule — Least Privilege

Always give the MINIMUM permissions needed. Never give AdministratorAccess unless absolutely required. This limits damage if credentials are stolen.

# Bad: Give admin access to a Lambda function
# {
#   "Effect": "Allow",
#   "Action": "*",
#   "Resource": "*"
# }

# Good: Only what the Lambda actually needs
{
  "Effect": "Allow",
  "Action": [
    "s3:GetObject",
    "dynamodb:PutItem"
  ],
  "Resource": [
    "arn:aws:s3:::my-bucket/*",
    "arn:aws:dynamodb:us-east-1:123456:table/orders"
  ]
}

IAM Roles vs Access Keys

MethodUse ForSecurity Level
IAM RoleEC2, Lambda, ECS — any AWS serviceBEST — auto-rotating temporary credentials
Access KeysCLI, CI/CD pipelines (if no OIDC)OK — rotate regularly, never commit to Git
Root Account KeysNEVERNEVER create or use these
Exam Tip: The exam loves questions about IAM Roles. If an EC2 instance needs to access S3 — use an IAM Role, NOT access keys embedded in code. If an answer says 'store credentials in the application' — that is WRONG.
Topic Quiz · 2 questions

Test your understanding before moving on

1. An EC2 instance needs to read files from S3. What is the MOST secure way to grant access?
💡 IAM Roles provide temporary auto-rotating credentials to EC2 instances — no key management needed.
2. What does the principle of least privilege mean in IAM?
💡 Least privilege means granting only what is needed and nothing more — reducing blast radius if credentials are compromised.