Why IAM is foundational in AWS - Why It Works

Introduction

IAM controls who can do what in your cloud. It keeps your resources safe by managing permissions carefully.

When you want to give a team member access to only the parts of your cloud they need.

When you need to allow an application to use cloud services securely without sharing passwords.

When you want to track who made changes to your cloud resources for safety and auditing.

When you want to prevent accidental or harmful changes by limiting permissions.

When you need to manage access for many users and services in a clear and organized way.

Commands

This command creates a new user named 'example-user' in IAM so you can assign permissions to them.

Terminal

aws iam create-user --user-name example-user

Expected Output

{

    "User": {

        "Path": "/",

        "UserName": "example-user",

        "UserId": "AIDAEXAMPLEUSERID",

        "Arn": "arn:aws:iam::123456789012:user/example-user",

        "CreateDate": "2024-06-01T12:00:00Z"

    }

}

→

--user-name - Specifies the name of the new IAM user.

This command attaches a policy to 'example-user' that allows read-only access to Amazon S3 storage.

Terminal

aws iam attach-user-policy --user-name example-user --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

Expected Output

No output (command runs silently)

→

--user-name - Specifies which user to attach the policy to.

→

--policy-arn - Specifies the exact policy to attach by its ARN.

This command lists all policies attached to 'example-user' so you can verify their permissions.

Terminal

aws iam list-attached-user-policies --user-name example-user

Expected Output

{

    "AttachedPolicies": [

        {

            "PolicyName": "AmazonS3ReadOnlyAccess",

            "PolicyArn": "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"

        }

    ]

}

→

--user-name - Specifies the user whose policies you want to list.

Key Concept

If you remember nothing else from this pattern, remember: IAM controls who can access what, keeping your cloud safe and organized.

Common Mistakes

Giving users full access without limiting permissions.

This can lead to accidental or malicious changes that harm your cloud resources.

Assign only the permissions users need using specific policies.

Sharing root account credentials instead of using IAM users.

Root credentials have full access and are risky to share or use regularly.

Create IAM users with limited permissions for daily tasks.

Not verifying attached policies after assignment.

You might think permissions are set correctly when they are not, causing access issues.

Use commands to list and confirm policies attached to users.

Summary

Create IAM users to control who can access your cloud.

Attach specific policies to users to limit what they can do.

Verify user permissions by listing attached policies.