AWS Identity and Access Management

AWS Identity and Access Management (IAM) is the AWS service that provides centralized identity and access control for AWS accounts and resources. It operates as a policy-based permission system where identities (users, groups, roles) are granted permissions through JSON policies and temporary credentials are issued via AWS Security Token Service when needed. IAM normally sits at the account and organization level and controls which principals can call AWS APIs or access resources within an AWS environment.

🗂 Resource Category

Security, Identity, and Compliance • Management and Governance

🧠 Exam Memory Hook

Think: "Users, roles, policies, and federation for account-level access control = AWS Identity and Access Management"

📖 Ownership

Classification: AWS Managed Service

AWS responsibilities: AWS operates and secures the IAM control plane and underlying service infrastructure, maintains the IAM service APIs, console, storage for IAM metadata, and applies patches to the managed service platform and underlying physical infrastructure. AWS provides the mechanisms for temporary credentials (via STS), policy evaluation, and integrations that allow other AWS services to authenticate and authorize requests. AWS is responsible for availability and operational management of the IAM service platform itself.

Customer responsibilities: The customer configures identities (users, groups, roles), JSON policies, permission boundaries, role trust policies, identity federation settings, access keys, and MFA; the customer also monitors access patterns, audits changes with services like AWS CloudTrail, rotates long‑term credentials, enforces least-privilege, and manages application-level secrets and libraries. Customers must also configure service-linked roles, delegate access across accounts when needed, and implement organizational controls such as AWS Organizations SCPs and IAM permission boundaries where appropriate.

Patching responsibilities: AWS patches and maintains the physical infrastructure, network, hypervisor, and the managed IAM service platform (including service runtimes and libraries used by IAM). The customer does not patch the IAM service platform; however, the customer is responsible for patching and maintaining any guest operating systems, runtimes, application libraries, dependencies, and customer-deployed applications that call AWS APIs or embed AWS credentials.

🏗 Typical Architecture

💡 Top 5 Features

Policy-based access control using JSON IAM policies attached to users, groups, or roles.
Roles and temporary security credentials via AWS Security Token Service (STS) for short-lived permissions.
Identity federation support for external identity providers using SAML and OIDC.
Resource-based policies and service-linked roles to allow cross-service access delegation where supported.
Managed policies and permission boundaries to simplify permission management and enforce limits.

✅ Top 5 Use Cases

Granting EC2 instances and Lambda functions permissions to access AWS APIs without embedding long-term credentials by using IAM roles.
Federating corporate identities to AWS Console and APIs so workforce SSO can be enforced by the corporate IdP.
Enabling cross-account access between AWS accounts by creating roles with appropriate trust and permission policies.
Applying least-privilege access and permission boundaries to limit what administrators or tenants can do in multi-team accounts.
Issuing temporary credentials for third-party integrations or CI/CD pipelines to reduce exposure of long-lived credentials.

🏗 Architecture Placement

IAM is an account- and organization-level control plane service that is globally scoped and used by AWS services, APIs, SDKs, the management console, and federated identities to authenticate and authorize requests. AWS services request IAM for permission evaluation when a principal calls an AWS API or when a service assumes a role on behalf of a workload. IAM integrates with organization-level controls (AWS Organizations), audit services (AWS CloudTrail), and identity federation endpoints. Depending on configuration, IAM controls apply across regions for account-scoped resources and to regional resources where permissions are evaluated.

🎯 Commonly Used With

- Amazon EC2
- AWS Lambda
- Amazon S3
- AWS CloudTrail
- AWS Organizations

🌍 5 Real-World Examples

A bank uses SAML federation with IAM roles so employees sign in with corporate credentials and assume role-based access to production accounts for audit-controlled access.
An online media company assigns an IAM role to Lambda functions so transcoding code can read and write objects in S3 without embedding access keys.
A healthcare provider implements strict IAM policies and permission boundaries to limit which teams can access patient data stored in AWS services, improving auditability.
A retail platform creates cross-account roles to allow a vendor account to upload inventory to a staging S3 bucket without sharing long-term credentials.
A telecommunications operator deploys service-linked roles so monitoring and logging services can collect telemetry from resources while minimizing manual permission configuration.

🎓 AWS Exam Clues

Prefer IAM roles and temporary credentials (STS) over long-term access keys for workloads running on AWS services.
IAM is account-scoped and globally managed; service features such as policies apply at the account/organization level.
Use AWS Organizations SCPs, permission boundaries, and IAM policies together when enforcing account-level restrictions.
Enforce least-privilege with explicit allow statements and avoid broad wildcard permissions in IAM policies.
Audit IAM changes and usage with AWS CloudTrail and use MFA for privileged users and role escalation.

📝 Quick Revision

IAM centralises identity and permission management for AWS accounts using users, groups, roles, and JSON policies. Use roles and STS for temporary credentials, enforce least-privilege, enable federation for SSO, and monitor with CloudTrail and IAM Access Analyzer.

🏷 Keywords

Users • Groups • Roles • Policies • Permission boundaries • AWS STS • Temporary credentials • Identity federation • SAML • OIDC • Service-linked role • Access keys