IAM: Users & Groups

IAM: Users & Groups

1. Identity and Access Management, Global service

2. Root account created by default, shouldn’t be used or shared

3. Groups only contain users, not other groups

   • Users don’t have to belong to a group, and user can belong to multiple groups
   • Users or Groups can be assigned JSON documents called policies
     • policies define the permissions of the users
       • Least privilege principle: don’t give more permissions than a user needs
       • roles
         • Some AWS service will need to perform actions on your behalf
           • Common roles: EC2 Instance Roles; Lambda Function Roles; Roles for CloudFormation
     • Policies are inherited by users from their groups
     • Policies Structure
       • Consists of
         • id
         • version
         • statemets
           • Sid: an identifier for the statement (optional)
           • Effect: whether the statement allows or denies access (Allow, Deny
           • Principal: account/user/role to which this policy applied to
           • Resource: list of resources to which the actions applied to
           • Action: list of actions this policy allows or denies
           • Condition: conditions for when this policy is in effect: optional
     • Password Polices
       • Polices to higher security(specify character, change pass after some time, etc.)
       • MFA

4. Users are people within your organization, and can be grouped

5. AWS Access

   • AWS Management Console (protected by password + MFA)
   • AWS Command Line Interface (CLI): protected by access keys
     • Access Key
       • Access Key ID ~= username
       • Secret Access Key ~= password
     • command line shell
       • direct access to the public api of aws services
       • develop scripts
     • open source
       • https://github.com/aws/aws-cli
   • AWS Software Developer Kit (SDK) - for code: protected by access keys
     • Language-specific APIs
     • Access and manage AWS services programmatically
     • Supports: SDKs (JavaScript, Python, PHP, .NET, Ruby, Java, Go, Node.js, C++) • Mobile SDKs (Android, iOS, …) • IoT Device SDKs (Embedded C, Arduino, …)
       • Example: AWS CLI is built on AWS SDK for Python

6. Audity

   • IAM Access Advisor (user-level)
     • Access advisor shows the service permissions granted to a user and when those services were last accessed
     • use this information to revise your policies.
   • IAM Credentials Report (account-level)
     • that lists all account's users and the status of their various credentials