Beginner LevelCloud Computing (AWS/GCP/Azure)
How does AWS IAM (Identity and Access Management) control access using Roles and Policies?
❓ Interview Prompt: Explain AWS IAM Users, Groups, Roles, JSON Permission Policies, and temporary STS security credentials.
AWS IAM (Identity and Access Management) manages authentication and authorization across your AWS resources.
Core IAM Entities:
1
IAM Users: Represents a human user or service requiring long-term credentials (access keys/passwords). Best Practice: Minimize long-term IAM Users.
2
IAM Groups: Collections of users. Attach policies to groups rather than individual users.
3
IAM Roles: An identity with permission policies that can be assumed temporarily by humans or AWS services (e.g. EC2 instance, Lambda function, EKS Pod) using AWS Security Token Service (STS).
4
IAM Policies: JSON documents defining explicit 'Allow' or 'Deny' permissions over 'Effect', 'Action', 'Resource', and 'Condition'.
Default Security Rule:
Implicit Deny: All permissions are denied by default. An explicit 'Deny' statement always overrides any 'Allow'.
Code Implementation Example
json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["s3:GetObject", "s3:ListBucket"],
"Resource": [
"arn:aws:s3:::company-app-data",
"arn:aws:s3:::company-app-data/*"
]
}
]
}💡AWS IAM JSON policy granting read-only access to a specific S3 bucket.
🎯 Interview Key Takeaway
Use IAM Roles for temporary service access rather than long-term IAM user access keys, enforcing least privilege JSON policies.
#IAM#AWS Security#Roles#Policies#Beginner
Back to all Cloud Computing (AWS/GCP/Azure) Questions→