IAM (Identity and Access Management) decides who may do what in the account. It answers every request any service receives, and it costs nothing.
Every request has three parts
who asksprincipal
wants to
s3:GetObjectaction
on
report.csvresource
IAM checks the policies
allow or denythe answer
The principal is the identity making the request. The action is what it wants to do, written as a service and an operation. The resource is the thing it wants to do it to.
What IAM holds
| Kind | What it is |
|---|---|
| user | an identity for one person or one program, with long-term credentials |
| role | an identity that others take on for a while, with no long-term credentials |
| group | not an identity: a collection of users that share permissions |
| policy | a JSON document of rules: which actions on which resources are allowed or denied |
Policies are attached to users, groups and roles. An identity can do exactly what its policies allow, and nothing else: anything no policy allows is denied. A new user starts with no policies, so it can do nothing at all.
The users that exist
sh
aws iam list-usersjson
{
"Users": [
{
"UserName": "admin",
"Arn": "arn:aws:iam::123456789012:user/admin"
}
]
}Only admin so far, the user the terminal signs in as. The rest of this chapter adds users, groups, policies and roles, one at a time.