Identity Access Management - IAM → centrally manage users, security credentials such as access keys, and permissions that control which AWS resources users can access

IAM Users + Groups

create Users and assign them individual security credentials (access keys, passwords, and multi-factor authentication devices). You can manage permissions to control which operations a User can perform

• Groups → organize Users into Groups
  • Permissions → uses Policies
• Security Credentials

IAM Policy

• Effect says whether to Allow or Deny the permissions.
• Action specifies the API calls that can be made against an AWS Service (eg cloudwatch:ListMetrics).
• Resource defines the scope of entities covered by the policy rule (eg a specific Amazon S3 bucket or Amazon EC2 instance, or * which means any resource).

IAM Roles

similar to a User, in that it is an AWS identity with permission policies that determine what the identity can and cannot do in AWS. However, instead of being uniquely associated with one person, a Role is intended to be assumable by anyone who needs it

identity federation

allow existing users in your enterprise to access the AWS Management Console, to call AWS APIs and to access resources, without the need to create an IAM User for each identity

knowledge check

• IAM Roles → They grant permissions without sharing long-term access keys
• identity federation → While IAM Roles can be used with federated users, they don't provide the authentication mechanism itself
  • ex. a company wants to allow their employees to use their existing corporate credentials to access AWS resources
• least privilege in IAM → only grant permissions to perform necessary tasks
• AWS managed policy → created and managed by AWS. They are designed for common use cases and cannot be modified by users
• inline policies → policies are created and managed by users, embedded directly in a single user, group, or role
• policies → IAM uses policies to define permissions. These are JSON documents that specify what actions are allowed or denied on what AWS resources.