backend / cloud aws / security identity and compliance / README.md

AWS Identity and Access Management (IAM)

7 min read index source

AWS Identity and Access Management (IAM)

Overview

AWS Identity and Access Management (IAM) is a web service that helps you securely control access to AWS resources. IAM enables you to manage users, security credentials such as access keys, and permissions that control which AWS resources users and applications can access.

Key Features

  • Users: Individual AWS accounts with unique credentials
  • Groups: Collections of users for easier permission management
  • Roles: Permissions that can be assumed by users, applications, or services
  • Policies: JSON documents that define permissions
  • Access Keys: Long-term credentials for programmatic access
  • Temporary Credentials: Short-term credentials for enhanced security
  • Multi-Factor Authentication (MFA): Additional security layer
  • Cross-Account Access: Access resources across AWS accounts

Interview Topics

1. IAM Fundamentals

  • Users: Individual identities with credentials
  • Groups: Collections of users with shared permissions
  • Roles: Permissions that can be assumed temporarily
  • Policies: JSON documents defining permissions
  • Principle of Least Privilege: Grant minimum necessary permissions

2. IAM Policies

  • Managed Policies: AWS-managed and customer-managed policies
  • Inline Policies: Embedded directly in users, groups, or roles
  • Policy Structure: Version, Statement, Effect, Action, Resource
  • Policy Evaluation: How AWS evaluates multiple policies
  • Condition Keys: Additional criteria for policy evaluation

3. IAM Roles

  • Service Roles: Used by AWS services
  • User Roles: Assumed by IAM users
  • Cross-Account Roles: Access across AWS accounts
  • Instance Profiles: Roles for EC2 instances
  • Role Chaining: Assuming roles from other roles

4. Security Features

  • MFA: Multi-factor authentication
  • Access Keys: Long-term credentials management
  • Temporary Credentials: STS (Security Token Service)
  • Credential Reports: Audit user credentials
  • Access Analyzer: Identify unused permissions

5. Advanced Features

  • Organizations: Multi-account management
  • Service Control Policies (SCPs): Organization-wide permissions
  • Permission Boundaries: Limit maximum permissions
  • Resource-based Policies: Attached to AWS resources
  • Cross-Account Access: Resource sharing across accounts

Common Interview Questions

Basic Questions

  1. What is AWS IAM and why is it important?

    • Centralized access control for AWS resources
    • Manages users, groups, roles, and policies
    • Implements security best practices
    • Provides audit and compliance capabilities

  2. What are the main components of IAM?

    • Users: Individual identities
    • Groups: Collections of users
    • Roles: Temporary permissions
    • Policies: Permission definitions
    • Access keys: Programmatic access

  3. How do you create an IAM user?

    aws iam create-user --user-name "MyUser"
aws iam attach-user-policy --user-name "MyUser" --policy-arn "arn:aws:iam::aws:policy/AdministratorAccess"

Advanced Questions

  1. How do you create a custom IAM policy?

    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::my-bucket/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/Environment": "Production"
        }
      }
    }
  ]
}

  2. What is the difference between IAM roles and IAM users?

    • Users: Long-term identities with permanent credentials
    • Roles: Temporary permissions that can be assumed
    • Users: Direct access to AWS services
    • Roles: Assumed by users, applications, or services

  3. How do you implement cross-account access with IAM?

    • Create IAM role in target account
    • Configure trust policy for source account
    • Grant necessary permissions to role
    • Assume role from source account

Troubleshooting Questions

  1. What if an IAM user can’t access a specific AWS service?

    • Check user permissions and policies
    • Verify policy attachments
    • Review policy conditions
    • Check for explicit denies

  2. How do you troubleshoot IAM policy issues?

    • Use IAM Policy Simulator
    • Check policy evaluation logic
    • Review CloudTrail logs
    • Verify resource ARNs

Best Practices

1. Security

  • Follow principle of least privilege
  • Use IAM roles instead of access keys
  • Enable MFA for all users
  • Regularly rotate access keys

2. Policy Management

  • Use managed policies when possible
  • Create custom policies for specific needs
  • Use conditions for fine-grained control
  • Regularly review and update policies

3. User Management

  • Use groups for permission management
  • Implement strong password policies
  • Monitor user activity
  • Regular access reviews

4. Role Management

  • Use service roles for AWS services
  • Implement least privilege for roles
  • Use permission boundaries
  • Monitor role usage

5. Monitoring

  • Enable CloudTrail for audit logging
  • Use IAM Access Analyzer
  • Monitor credential usage
  • Set up CloudWatch alarms

Use Cases

1. Application Access

  • Service-to-service authentication
  • Application credentials management
  • Cross-service permissions
  • Temporary access control

2. User Management

  • Employee access control
  • Contractor access management
  • Role-based access control
  • Compliance requirements

3. Cross-Account Access

  • Multi-account organizations
  • Resource sharing
  • Centralized management
  • Security isolation

4. Compliance and Audit

  • Access logging and monitoring
  • Policy compliance
  • Security assessments
  • Regulatory requirements

Integration Patterns

1. AWS Service Integration

  • Service roles for AWS services
  • Resource-based policies
  • Cross-service permissions
  • Service-to-service auth

2. Application Integration

  • Application roles
  • Temporary credentials
  • SDK integration
  • API access control

3. External Integration

  • SAML federation
  • OAuth integration
  • Cross-account access
  • Third-party authentication

4. Monitoring Integration

  • CloudTrail integration
  • CloudWatch monitoring
  • Security Hub integration
  • Compliance reporting

Security Considerations

1. Access Control

  • Implement least privilege
  • Use role-based access
  • Regular access reviews
  • Monitor access patterns

2. Credential Management

  • Use temporary credentials
  • Rotate access keys regularly
  • Implement MFA
  • Secure credential storage

3. Policy Security

  • Use managed policies
  • Implement permission boundaries
  • Regular policy reviews
  • Test policy changes

4. Audit and Compliance

  • Enable comprehensive logging
  • Monitor policy changes
  • Track access patterns
  • Maintain audit trails

Cost Optimization

1. Policy Optimization

  • Use managed policies
  • Consolidate similar policies
  • Remove unused policies
  • Optimize policy conditions

2. User Management

  • Regular user cleanup
  • Remove unused access keys
  • Consolidate user accounts
  • Monitor user activity

3. Role Optimization

  • Use appropriate role types
  • Implement permission boundaries
  • Monitor role usage
  • Remove unused roles

4. Monitoring Costs

  • Optimize CloudTrail logging
  • Use appropriate monitoring
  • Track IAM usage
  • Monitor compliance costs

Performance Optimization

1. Policy Performance

  • Optimize policy structure
  • Use appropriate conditions
  • Minimize policy size
  • Monitor evaluation time

2. Role Performance

  • Optimize role assumptions
  • Use appropriate session duration
  • Monitor role chaining
  • Optimize cross-account access

3. User Performance

  • Optimize user management
  • Use groups effectively
  • Monitor user activity
  • Optimize credential usage

4. Scalability

  • Design for growth
  • Use organizations for scale
  • Implement automation
  • Monitor capacity limits

Disaster Recovery

1. Policy Backup

  • Backup IAM policies
  • Document policy structure
  • Maintain policy versions
  • Test policy restoration

2. User Recovery

  • Backup user configurations
  • Document user permissions
  • Maintain access procedures
  • Test user restoration

3. Role Recovery

  • Backup role configurations
  • Document trust relationships
  • Maintain role procedures
  • Test role restoration

4. Service Continuity

  • Monitor IAM service health
  • Implement backup procedures
  • Maintain operational procedures
  • Test recovery processes

Migration Strategies

1. From Manual Access

  • Map existing access patterns
  • Create equivalent IAM policies
  • Migrate users gradually
  • Test access thoroughly

2. From Other IAM Systems

  • Map existing policies
  • Create equivalent IAM structure
  • Migrate users and roles
  • Validate functionality

3. Application Migration

  • Plan IAM requirements
  • Configure appropriate policies
  • Migrate applications
  • Test access control

Common Pitfalls

1. Security Issues

  • Overly permissive policies
  • Inadequate access control
  • Poor credential management
  • Insufficient monitoring

2. Policy Problems

  • Complex policy structures
  • Inefficient policy evaluation
  • Poor policy organization
  • Inadequate testing

3. User Management Issues

  • Inadequate user cleanup
  • Poor group organization
  • Insufficient access reviews
  • Inadequate monitoring

4. Compliance Issues

  • Inadequate audit trails
  • Poor policy documentation
  • Insufficient monitoring
  • Compliance violations

Resources

Interview angle

  • “How does IAM evaluate a request?” - explicit deny wins over everything; otherwise an explicit allow is required, and the default is deny. Add SCPs, permission boundaries and resource policies and the rule stays: any deny anywhere is final.
  • “Roles or access keys?” - roles, always, for anything running in AWS: instance profiles, task roles, IRSA for EKS, and OIDC federation for CI. Long-lived access keys are the credential that leaks into a repository and is still valid a year later.
  • “How do you scope permissions properly?” - start from the actions the workload actually calls, use resource ARNs rather than *, and add condition keys. IAM Access Analyzer can generate a policy from CloudTrail history, which is the practical way to reach least privilege on an existing service.
  • “What is a permission boundary?” - a ceiling on what an identity’s policies can grant. It is how you let a team create roles without letting them create one more powerful than their own.
  • “What is the confused deputy problem here?” - a third party assuming your cross-account role on someone else’s behalf. sts:ExternalId in the trust policy is the mitigation, and it is the answer interviewers listen for on cross-account questions.