AWS IAM Essential2010年〜
An authentication and authorization service for securely managing access to AWS resources
What It Does
AWS IAM (Identity and Access Management) is a service for securely controlling access to AWS resources. You can define in fine detail who (users, roles) can do what (read, write, delete) on which resources (S3, EC2, etc.). IAM itself is free to use and becomes available automatically when you create an AWS account.
Use Cases
Used for managing AWS access permissions per team member, controlling application access to AWS services, granting temporary access to external partners, implementing access policies based on compliance requirements, and managing access across multi-account environments. It serves as the security foundation of AWS.
Everyday Analogy
Think of it like a building access control system. Only people with an employee badge (IAM user) can enter the building, and each department has access to different floors (permissions). The accounting team can enter the finance system room, and the dev team can enter the server room, but they can't access each other's areas. Administrators can change permissions at any time.
What Is IAM?
AWS Identity and Access Management (IAM) is the service at the core of AWS security. When you create an AWS account, a root user with full permissions is created, but the best practice is to avoid using the root user for everyday tasks. Instead, create IAM users and roles with only the minimum permissions needed. IAM is a global service, meaning the same settings apply worldwide regardless of region.
Key Concepts
IAM has four key concepts. Users are identities that correspond to individuals and are used for console login and programmatic access. Groups are collections of users - when you assign permissions to a group, they apply to all members. Roles provide temporary permissions and are used to grant access to AWS services like EC2 instances and Lambda functions. Policies are permission definitions written in JSON format.
The Principle of Least Privilege
The most important practice in IAM is the principle of least privilege. Grant each user or role only the minimum permissions needed for their tasks. For example, a process that only reads S3 data should be given only S3 read permissions, not write or delete permissions. IAM Access Analyzer lets you analyze which permissions are actually being used and identify unnecessary ones. To get a comprehensive understanding of the principle of least privilege, specialized books (Amazon) are a great resource.
Getting Started
To get started with IAM, first create an administrator IAM user in the IAM console and minimize the use of the root user. Then create users and groups for your team members and assign AWS managed policies (pre-built permission sets). Enabling MFA (multi-factor authentication) protects your account even if a password is compromised.
Things to Watch Out For
- Do not use the root user for daily operations. Set up MFA and manage it securely
- Never hardcode access keys in source code. Use IAM roles or environment variables instead
- IAM is free to use, but misconfiguration can lead to security incidents, so always follow the principle of least privilege
