In this chapter, we are going to learn about AWS IAM. We will go through various IAM tools and features and their use cases and look at ways in which we can access IAM. We will deep dive into IAM authentication and authorization. Authentication includes identities such as users, roles, and groups, and authorization talks about access management, permissions, and policies for AWS resources. We'll walk through the benefits of IAM and how it can help us secure our AWS resources. Finally, we'll take a look at IAM best practices.

The following is a snapshot of what we'll cover in this chapter:

• IAM features and tools
• IAM authentication
• IAM authorization
• AWS credentials
• IAM limitations
• IAM best practices

This chapter will help us understand user authentication and access control in detail. Essentially, IAM is our first step towards securing our AWS resources...

IAM is free of cost. It is Payment Card Industry Data Security Standard (PCI-DSS) compliant, so you can run your credit card application and store credit card information using IAM. It is also eventually consistent, meaning any change you make in IAM would be propagated across multiple AWS data centers: this propagation could take a few milliseconds. So design your application and architecture keeping this feature in mind. IAM integrates with various AWS services so you can define fine grain access control for these services.

Let us look at other features of IAM that make it such a widely used, powerful, and versatile AWS service. As a matter of fact, if you have an AWS account and you want to use resources in your AWS account, you have to pass through IAM in one way or other, there's no two ways about it!

IAM authentication in AWS includes the following identities:

• Users
• Groups
• Roles
• Temporary security credentials
• Account root user

Identities are used to provide authentication for people, applications, resources, services, and processes in your AWS account. Identities represent the user that interacts with the AWS resources based on authentication and authorization to perform various actions and tasks. We will look at each one of the identities in detail.

You create an IAM user in AWS as an entity to allow people to sign into the AWS Management Console or to make requests to AWS services from your programs using CLI or API. An IAM user can be a person, an application, or an AWS service that interacts...

When you create an AWS account, it has a user known as root user. This user has, by default, access to all AWS service and resources. No other user (or any IAM entity) has any access by default and we have to explicitly grant access for all users. In this section, we'll talk about authorization in IAM or access management, it is made up of the following two components:

• Permissions
• Policy

Permissions let you take actions on AWS resources. It allows your users (AWS identities) to perform tasks in AWS. When you create a new user (except for the root user), it has no permission to take any action in AWS. You grant permissions to the user by attaching a policy to that user. So, for example,...

You can set up the password policy for your AWS account from IAM. Navigate to the IAM dashboard from the AWS console. Click on Account settings. As shown in the following figure, on the Password Policy page, you can setup requirements such as minimum password length, rotation period, and so on. Most of these changes in your password policy are effective when your users log in the next time, however, for changes such as change in the password expiration period, they are applied immediately:

As we have seen in the previous chapter, AWS provides you with various credentials to authorize and authenticate your requests. Let us look at these AWS credentials in detail:

• Email and password: These credentials are used by your account root user. As discussed earlier, by default, the account root user has access to all services and resources. AWS recommends that root user credentials should be used to create another user and all the work should be carried out by the other user.
• IAM username and password: When you create one or more users in your AWS account through IAM. They can login to the AWS console by using the username and password. This username is given by you when you create a user in IAM. Passwords for these users are created by you as well, you can give permissions to users to change their passwords.
• Multi-factor Authentication (MFA): MFA adds an...

IAM has certain limitations for entities and objects. Let us look at the most important limitations across the most common entities and objects:

• Names of all IAM identities and IAM resources can be alphanumeric. They can include common characters such as plus (+), equal (=), comma (,), period (.), at (@), underscore (_), and hyphen (-).
• Names of IAM identities (users, roles, and groups) must be unique within the AWS account. So you can't have two groups named DEVELOPERS and developers in your AWS account.
• AWS account ID aliases must be unique across AWS products in your account. It cannot be a 12 digit number.
• You can create 100 groups in an AWS account.
• You can create 5000 users in an AWS account. AWS recommends the use of temporary security credentials for adding a large number of users in an AWS account.
• You can create 500 roles in an AWS account.
• An IAM...

Lock root account keys: As we know the root account user has access to all resources for all AWS services by default, so if you have access keys (access key ID and secret access key) for a root account user, lock them in a secure place and rotate them periodically.

Do not share credentials: AWS gives you multiple ways for your users to interact with resources in your AWS account, so you would never have a requirement to share credentials. Create individual users for all access requirements with necessary credentials and never share credentials with other users.

Use managed policies: AWS provides comprehensive sets of policies that cover access requirements for the most common scenarios. AWS also provides you policies aligned with job functions. These policies are managed by AWS and they are updated as and when required so you don't have to worry about your...

This concludes Chapter 2, AWS Identity and Access Management. IAM is one of the most important AWS service as it controls access to your AWS resources. We had a detailed view of Identities including users, groups, and roles. We learnt how to create each of these identities and what features each of these identities offer to support multiple use cases.

We looked at identity federation to allow access for identities that are managed out of our AWS account. We learnt about delegation, temporary security credentials, AWS Security token service and account root user.

We also learnt about policies and permissions. We went through various elements of a policy. We got to know that AWS managed policies are preferred over inline policies for most use cases. There are multiple tools and features available to help us write, validate, and manage our own policies such as IAM policy...