What Is IAM?

This lesson will focus on the importance of IAM, its components, operational mechanisms, and best practices.

Why do we need IAM?

When we create an AWS account, we are provided with the login credentials. Using those credentials, we can log in as the root user. A root user has unrestricted access to all the AWS services and resources within our account. When working with AWS, we may need to provide different users or applications access to AWS services or resources. Providing them with the root user credentials is risky as it may lead to security breaches. IAM helps us provide that required access. It helps us create resources representing the requesting entities in our account and define their scope of permissions. Along with this, it helps us monitor, manage, and modify this access as per our requirements.

Components of IAM

IAM uses the following components to perform its operation:

• IAM entities: These are the  IAM resources to authenticate the requesting entity. These include the following:

  • IAM users

  • IAM roles

• IAM identities: The IAM resources that IAM uses to check the permissions scope of the requesting entity. These include the following:

  • IAM users

  • IAM roles

  • IAM groups

• Principal: The user, service, or application that requests access to an IAM service or a resource. It can be both an external or an internal entity.

• Other IAM resources: These are the IAM resources that do not fall into any of the above categories. These are used for a wide range of operations that deal with identity and access management. These include the following:

  • IAM policies

  • Identity providers

  • Access Analyzer

How IAM works

When an entity requests access to any of the AWS services or resources, that request is first analyzed by IAM. IAM checks the credentials provided by the requesting entity to authenticate it. After the requesting entity has been authenticated, it analyzes the permissions granted to the entity and checks if the current request falls into that pool of permissions. Upon verifying that the requesting entity is authorized to access the requested service/resource, IAM provides the requesting entity with the required access.

If the requesting entity fails any of these checks, its request is denied, and an appropriate denial reason is sent as the response to its request.

This lesson taught us about the AWS IAM, why it is needed, and the core components it uses for operation. We also gained insight into how IAM operates.