Cyber Code Academy
Tutorials Academy Courses
Home / AWS / IAM Introduction

IAM Introduction

Topic: AWS

AWS IAM — Introduction

AWS Identity and Access Management (IAM) is an AWS service that helps you securely control who can access your AWS resources and what actions they are allowed to perform.

For example, suppose your company has multiple developers working with AWS. You may want one developer to manage EC2 instances, another to access S3 buckets, and an administrator to manage everything. IAM allows you to create these permissions and control access securely.

What is AWS IAM?

IAM stands for Identity and Access Management.

It is a global AWS service used to manage:

  • Users
  • Groups
  • Roles
  • Policies
  • Permissions
  • Authentication
  • Authorization

In simple words:

IAM answers two important questions:

Who are you? → Authentication
What are you allowed to do? → Authorization

Why Do We Need IAM?

Imagine you have an AWS account and 10 developers are working on the same project.

If everyone uses the AWS root account, it creates a major security risk.

Instead, you can create individual IAM users and give each person only the permissions they need.

For example:

UserRequired Access
DeveloperEC2
Database AdminRDS
DevOps EngineerEC2 + VPC + CloudWatch
Storage AdminS3
Security AdminIAM

This follows the principle of Least Privilege.

Principle of Least Privilege

The principle of least privilege means:

Give a user only the permissions required to perform their job.

For example, if a developer only needs to restart an EC2 instance, there is no need to give that user full administrator access.

Important IAM Components

AWS IAM mainly consists of:

  1. Users
  2. Groups
  3. Policies
  4. Roles

Let’s understand each one.

1. IAM Users

An IAM user represents a person or application that needs access to AWS.

For example:

Krishna
Rahul
Amit
Developer1
Admin1

An IAM user can have:

  • Console access
  • Programmatic access
  • Permissions
  • MFA

Example:

Developer User
      ↓
IAM User
      ↓
EC2 Permissions
      ↓
Can manage EC2

2. IAM Groups

An IAM group is a collection of IAM users.

Instead of assigning the same permissions to every user individually, you can create a group and assign permissions to the group.

Example:

Developers
   ├── Krishna
   ├── Rahul
   └── Amit

You can attach an EC2 policy to the Developers group.

All users in that group can then receive the permissions provided by the policy.

Example

Developers Group
       ↓
EC2 Policy
       ↓
Krishna
Rahul
Amit

This makes permission management easier.

3. IAM Policies

Policies define what actions are allowed or denied.

IAM policies are generally written in JSON format.

Example:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::my-bucket"
    }
  ]
}

This policy allows the user to list the contents of a specific S3 bucket.

Important Policy Elements

Some important IAM policy elements are:

  • Effect
  • Action
  • Resource
  • Principal
  • Condition

For example:

"Effect": "Allow"

means the action is allowed.

While:

"Effect": "Deny"

means the action is denied.

4. IAM Roles

An IAM role is different from an IAM user.

A role is commonly used to provide temporary permissions to AWS services, applications, users, or workloads.

For example, suppose an EC2 instance needs to access an S3 bucket.

Instead of storing AWS access keys inside the EC2 server, you can create an IAM role and attach it to the EC2 instance.

EC2 Instance
      ↓
IAM Role
      ↓
S3 Permissions
      ↓
S3 Bucket

This is a much safer approach than storing long-term credentials on the server.

IAM Authentication vs Authorization

These two concepts are very important.

Authentication

Authentication means verifying who you are.

For example:

Username + Password
        ↓
Authentication
        ↓
AWS verifies your identity

MFA can provide an additional authentication factor.

Authorization

Authorization determines what you are allowed to do.

For example:

Krishna
   ↓
Authenticated
   ↓
IAM Policy
   ↓
Can access EC2
Cannot delete S3 bucket

So:

Authentication = Who are you?

Authorization = What can you do?

Root User vs IAM User

When you create an AWS account, AWS provides a root user.

The root user has extensive access to the AWS account.

For everyday AWS administration, you should avoid using the root user.

Instead:

Root User
    ↓
Create IAM identities
    ↓
Use appropriate permissions
    ↓
Perform daily AWS operations

The root user should be protected with strong security controls, including MFA.

IAM Policy Example

Suppose we want to allow a user to start and stop EC2 instances.

A simplified policy could look like:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:StartInstances",
        "ec2:StopInstances"
      ],
      "Resource": "*"
    }
  ]
}

The important part is:

"Action": [
  "ec2:StartInstances",
  "ec2:StopInstances"
]

The user is allowed to start and stop EC2 instances.

This demonstrates why IAM policies are powerful: permissions can be made very specific.

IAM Real-World Example

Suppose Cyber Code Academy has three employees:

Admin
Developer
Trainer

The requirements are:

Admin

Needs access to most AWS services.

Admin
 ↓
Administrator permissions

Developer

Needs EC2 and S3 access.

Developer
    ↓
EC2 + S3 permissions

Trainer

Only needs to view certain resources.

Trainer
   ↓
Read-only permissions

Instead of giving everyone administrator access, IAM allows you to provide permissions according to their responsibilities.

IAM Best Practices

Some important IAM security practices are:

1. Don’t use the root user for daily tasks

Use appropriate IAM identities instead.

2. Enable MFA

Multi-factor authentication provides an additional layer of security.

3. Follow Least Privilege

Give only the permissions that are required.

4. Use IAM Roles for AWS Services

For example:

EC2 → IAM Role → S3

instead of putting long-term AWS credentials inside the server.

5. Avoid Sharing Credentials

Every person should have their own identity where appropriate.

6. Review Permissions Regularly

Remove permissions that are no longer required.

7. Protect Access Keys

Never publish AWS access keys in:

  • GitHub
  • Public repositories
  • Screenshots
  • Chat messages
  • Source code

IAM Architecture

A simplified IAM architecture looks like this:

                 AWS Account
                     │
          ┌──────────┴──────────┐
          │                     │
       IAM Users             IAM Roles
          │                     │
       Groups              AWS Services
          │                     │
       Policies               Policies
          │                     │
          └──────────┬──────────┘
                     │
                Permissions
                     │
              AWS Resources

IAM vs AWS IAM Identity Center

AWS IAM manages identities and permissions within AWS.

IAM Identity Center is designed to provide centralized workforce access across AWS accounts and applications.

For a small AWS learning project, you will commonly start by learning:

IAM Users
IAM Groups
IAM Policies
IAM Roles
MFA
Least Privilege

Then you can move toward IAM Identity Center and more advanced identity management.

Practical Lab

Let’s create a simple IAM user.

Step 1: Open AWS Console

Go to the AWS Management Console and open IAM.

Step 2: Open Users

Navigate to:

IAM
 → Users
 → Create user

Step 3: Create a User

Example:

Username: developer1

Step 4: Configure Permissions

For learning purposes, you can attach an appropriate AWS-managed policy.

For production environments, prefer carefully scoped permissions rather than giving broad administrator access.

Step 5: Enable MFA

Configure MFA according to your organization’s security requirements.

Step 6: Test Access

Log in with the appropriate identity and verify that the user can perform only the intended operations.

IAM Interview Questions

1. What is AWS IAM?

IAM is an AWS service used to manage identities and permissions for accessing AWS resources.

2. What is an IAM user?

An IAM user represents an identity that can authenticate and receive permissions in an AWS account.

3. What is an IAM group?

A group is a collection of IAM users to which permissions can be assigned.

4. What is an IAM policy?

A policy is a JSON document that defines permissions.

5. What is an IAM role?

A role provides permissions that can be assumed by trusted entities such as AWS services, applications, or users.

6. What is least privilege?

It means providing only the permissions required to perform a task.

7. Why should you avoid using the root user for daily tasks?

Because the root user has extensive account privileges, making its credentials especially sensitive.

8. Why is MFA important?

MFA adds another authentication factor, reducing the risk associated with a compromised password.

What to Learn Next

After completing this introduction, follow this sequence:

AWS IAM Introduction
        ↓
IAM Users
        ↓
IAM Groups
        ↓
IAM Policies
        ↓
IAM Roles
        ↓
IAM Permissions
        ↓
MFA
        ↓
IAM Policy JSON
        ↓
IAM Role with EC2
        ↓
IAM Best Practices

Once you understand these concepts, you will have a strong foundation for AWS security and can move on to EC2 and VPC.

Want to learn this professionally?

Explore practical IT training at Cyber Code Academy.

View Academy Courses