← All notes

IAM Part 2

March 19, 2025

IAM - Identity and Access Management

Today, we continue talking about IAM again.
I finished this topic, but I only got 7/9 on the test, so I’ll try again tomorrow.
I need to review classes 27 and 29.

IAM: Multi-Factor Authentication (MFA)

Password Policy

Strong passwords = Higher security.
In AWS, you can set up a password policy with the following rules:

  • Minimum password length
  • Require specific character types:
    • Uppercase letters
    • Lowercase letters
    • Numbers
    • Non-alphanumeric characters
  • Allow IAM users to change their own passwords
  • Require password changes periodically
  • Prevent password reuse

Multi-Factor Authentication (MFA)

Users can access your account and potentially change configurations or delete resources.
To enhance security, AWS recommends enabling MFA for Root Accounts and IAM users.

MFA = Password you know + Security device you own

MFA Device Options in AWS

  • Virtual MFA Devices → Google Authenticator, Authy
  • Universal 2nd Factor (U2F) Security Keys → YubiKey
  • Hardware Key Fob MFA Devices → Gemalto (3rd party)
  • AWS GovCloud (US) Hardware MFA Devices → SurePassID (3rd party)

How Can Users Access AWS?

Users can interact with AWS in multiple ways:

  1. AWS Management Console → Protected by password + MFA
  2. AWS CLI (Command Line Interface) → Protected by access keys
  3. AWS SDK (Software Development Kit) → Used for automation in code, also protected by access keys

Access keys are secret, just like passwords. Never share them!

AWS CLI (Command Line Interface)

  • A tool that enables interaction with AWS services via commands
  • Direct access to AWS public APIs
  • Useful for automation via scripts
  • Open-source
  • Alternative to AWS Management Console

AWS SDK (Software Development Kit)

  • Language-specific APIs for AWS services
  • Enables programmatic access to AWS
  • Embedded within applications
  • Supports multiple languages

IAM Roles

Some AWS services need to perform actions on your behalf.
To grant them permissions, we assign IAM Roles.

Common IAM Roles

  • EC2 Instance Roles
  • Lambda Function Roles
  • CloudFormation Roles

IAM Security Tools

IAM Credentials Report (Account-Level)

  • Lists all IAM users and the status of their credentials.

IAM Access Advisor (User-Level)

  • Shows the service permissions assigned to a user.
  • Displays the last time each service was accessed.
  • Helps revise and optimize policies.

IAM Best Practices

✅ Never use the root account, except for AWS setup.
✅ One physical user = One AWS user.
✅ Assign users to groups and set permissions at the group level.
✅ Enforce a strong password policy.
✅ Enable MFA for all users.
✅ Use IAM Roles to grant AWS services permissions.
✅ Audit permissions using IAM Credentials Reports & IAM Access Advisor.
🚫 Never share IAM users & access keys!

Shared Responsibility Model for IAM

AWS Responsibilities

  • Infrastructure security
  • Global network security
  • Vulnerability analysis
  • Compliance validation

Your Responsibilities (Users/Organizations)

  • Managing Users, Groups, Roles, and Policies
  • Enabling MFA on all accounts
  • Rotating access keys frequently
  • Using IAM tools to apply appropriate permissions
  • Analyzing access patterns & reviewing permissions