IAM & AWS CLI - Complete Guide

Overview

IAM (Identity and Access Management) is a global service that manages authentication and authorization in AWS. When you create a user in IAM, it's available in all regions.

Users and Groups

Root User

• Created automatically when AWS account is created
• Has complete, unrestricted access to all AWS services
• Should only be used for initial account setup
• Never share root account credentials

IAM Users

• Represent one physical person within your organization
• Have their own credentials (password for console, access keys for CLI/SDK)
• Can be grouped together for easier permission management

Organization
├── Developers Group
│   ├── Alice
│   ├── Bob
│   └── Charles
├── Operations Group
│   ├── David
│   └── Edward
└── Fred (no group - not best practice)

IAM Groups

• Containers for users only
• Cannot contain other groups
• Users can belong to multiple groups
• No default group that includes all users

IAM Policies

What are Policies?

JSON documents that define permissions - what users/groups/roles are allowed or denied to do.

Policy Inheritance

┌───────────────────┐          ┌───────────────────┐
│ Developers Group  │          │ Operations Group  │
│    (Policy A)     │          │    (Policy B)     │
└─────────┬─────────┘          └─────────┬─────────┘
          │                              │
    ┌─────┼─────┐                  ┌─────┴─────┐
    ▼     ▼     ▼                  ▼           ▼
┌───────┐ ┌───────┐ ┌───────┐ ┌───────┐   ┌───────┐
│ Alice │ │  Bob  │ │Charles│ │ David │   │Edward │
└───────┘ └───────┘ └───┬───┘ └───┬───┘   └───────┘
                        │         │
                        └────┬────┘
                             ▼
                    ┌─────────────────┐
                    │   Audit Team    │
                    │   (Policy C)    │
                    └─────────────────┘

┌─────────────────┐
│  Inline Policy  │────▶ Fred (no group)
└─────────────────┘

• Users inherit policies from all groups they belong to
• Users can have inline policies attached directly
• Charles (in Developers + Audit) gets policies from both groups

Policy Structure

{
    "Version": "2012-10-17",
    "Id": "S3-Account-Permissions",
    "Statement": [
        {
            "Sid": "1",
            "Effect": "Allow",
            "Principal": {
                "AWS": ["arn:aws:iam::123456789012:root"]
            },
            "Action": [
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Resource": ["arn:aws:s3:::mybucket/*"],
            "Condition": {
                "StringEquals": {
                    "aws:RequestedRegion": "eu-west-1"
                }
            }
        }
    ]
}

Policy Types

Wildcards in Policies

{
    "Effect": "Allow",
    "Action": [
        "iam:Get*",
        "iam:List*"
    ],
    "Resource": "*"
}

• * means anything
• iam:Get* matches GetUser, GetGroup, GetPolicy, etc.
• Resource: "*" applies to all resources

{
    "Version": "2012-10-17",
    "Id": "S3-Account-Permissions",
    "Statement": [
        {
            "Sid": "1",
            "Effect": "Allow",
            "Principal": {
                "AWS": ["arn:aws:iam::123456789012:root"]
            },
            "Action": [
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Resource": ["arn:aws:s3:::mybucket/*"],
            "Condition": {
                "StringEquals": {
                    "aws:RequestedRegion": "eu-west-1"
                }
            }
        }
    ]
}

{
    "Effect": "Allow",
    "Action": [
        "iam:Get*",
        "iam:List*"
    ],
    "Resource": "*"
}

Password Policy

Configure password requirements for IAM users:

• Minimum password length
• Require specific character types:
  • Uppercase letters
  • Lowercase letters
  • Numbers
  • Non-alphanumeric characters
• Allow users to change their own password
• Password expiration (e.g., every 90 days)
• Prevent password reuse

Multi-Factor Authentication (MFA)

Why MFA?

Adds a second layer of security:

• Something you know (password)
• Something you have (MFA device)

Even if password is stolen/hacked, account remains protected without the physical device.

MFA Device Options

AWS Access Methods

Three Ways to Access AWS

Access Keys

• Generated through Management Console
• Consist of:
  • Access Key ID (like username)
  • Secret Access Key (like password)
• Never share access keys - treat them like passwords
• Users manage their own access keys

AWS CLI

# Configure CLI with access keys
aws configure

# Example: List IAM users
aws iam list-users

# Example: Copy file to S3
aws s3 cp file.txt s3://mybucket/

• Direct access to public APIs of AWS services
• Develop scripts to automate tasks
• Open-source (available on GitHub)
• Built on AWS SDK for Python (Boto)

# Configure CLI with access keys
aws configure

# Example: List IAM users
aws iam list-users

# Example: Copy file to S3
aws s3 cp file.txt s3://mybucket/

AWS SDK

• Language-specific libraries (JavaScript, Python, PHP, .NET, Ruby, Java, Go, Node.js, C++)
• Mobile SDK (Android, iOS)
• IoT Device SDK
• Embed in your application code

AWS CloudShell

• Browser-based terminal in AWS Console
• Pre-configured with AWS CLI
• Free to use
• Files persist across sessions
• Not available in all regions

IAM Roles

What are Roles?

IAM identities for AWS services (not physical users) that need to perform actions on your behalf.

┌──────────────┐      ┌──────────────┐      ┌──────────────┐
│ EC2 Instance │─────▶│   IAM Role   │─────▶│  Access S3   │
└──────────────┘      └──────┬───────┘      └──────────────┘
                  Assumes    │
                             │ Permissions
                             ▼
                      ┌──────────────┐
                      │Access DynamoDB│
                      └──────────────┘

Common Role Use Cases

Creating a Role

1. Choose trusted entity type (AWS service)
2. Select the service (e.g., EC2)
3. Attach permission policies
4. Name the role

IAM Security Tools

IAM Credentials Report

• Account-level report
• Lists all users and status of their credentials:
  • Password enabled/last used/last changed
  • MFA active
  • Access keys created/last used/last rotated
• Useful for security audits

IAM Access Advisor

• User-level tool
• Shows service permissions granted to a user
• Shows when services were last accessed
• Helps implement least privilege principle

IAM Best Practices

1. Don't use root account except for initial setup
2. One physical user = One AWS user (never share credentials)
3. Assign users to groups, manage permissions at group level
4. Create strong password policy
5. Enable MFA for root and privileged users
6. Use Roles for AWS services (not access keys)
7. Use Access Keys for CLI/SDK (keep them secret)
8. Audit permissions with:
   • IAM Credentials Report
   • IAM Access Advisor
9. Never share IAM users or access keys

Summary

Questions & Answers