IAM and Security

IAM policies are either identity policy when they are attached to users, groups, and roles, or resource policy when they are attached to resources.

Each policy contain statements, each statement matches a request based on the action and the target resource, it either allow or deny.

Groups are not true identity they can't login to the system or referenced from resource policy.

Groups are used for administrative usage where attached managed or inline policies flow to its members

Roles can be assumed by AWS Identity, AWS account, web identity, anonymous .

Roles have trusted policy which state who can assume the role, and permission policy which states what they can and can't do.

Roles have short-term credentials created by Security Token Service (STS).

AWS organization helps managing multiple AWS accounts within one business, to allows creating consolidated bill.

Role switching is when a user from one account assumes a role from another account

Contenido del apunte (4)