Identity & Access Fundamentals

Learning Path

📘 Phase 1 – Overview

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand Identity and Access Management (IAM).
Explain authentication and authorisation.
Understand the principle of Least Privilege.
Differentiate IAM Users, Groups, Roles and Policies.
Understand Multi-Factor Authentication (MFA).
Learn enterprise identity management concepts.
Apply IAM best practices within AWS environments.

📚 Lesson Information

Estimated Time: 120 Minutes

Difficulty: Beginner

Prerequisites: CIA Triad

Hands-on Lab: Yes

Assignment: Yes

💼 Business Value

Identity is the new security perimeter.

Modern organisations no longer rely only on firewalls to protect their environments. Every user, application, API, and workload has an identity that must be authenticated and authorised before accessing cloud resources.

Industry reports consistently show that compromised credentials are one of the leading causes of cloud security incidents.

As a Cloud Security Engineer, securing identities is your highest priority.

🌍 What is Identity and Access Management (IAM)?

Identity and Access Management (IAM) is the process of ensuring that the right identity has the right access to the right resource at the right time, and for the right reason.

IAM answers four important questions:

Who is requesting access?
What are they trying to access?
Are they allowed?
What actions can they perform?

Without IAM, cloud environments cannot be secured.

🏢 Why IAM Matters

Every cloud environment contains identities such as:

Employees
Contractors
Applications
Virtual Machines
Containers
Lambda Functions
APIs
Third-party Services

Every identity must be authenticated before access is granted.

Poor identity management can result in:

Data breaches
Privilege escalation
Insider threats
Compliance violations
Financial loss

🔑 Authentication vs Authorisation

These two concepts are often confused.

Authentication

Authentication verifies who you are.

Examples include:

Username and Password
Multi-Factor Authentication (MFA)
Fingerprint
Face Recognition
Smart Card
Security Key

Example:

“Please prove your identity.”

Authorisation

Authorisation determines what you are allowed to do.

Examples:

Read a file
Delete an S3 bucket
Launch an EC2 instance
Create an IAM user

Example:

“Now that we know who you are, what permissions do you have?”

Simple Analogy

Imagine entering an office building.

Authentication is showing your employee ID at reception.

Authorisation determines which floors and rooms your access card allows you to enter.

🔐 IAM Components

AWS Identity and Access Management includes several core components.

IAM Users

An IAM User represents a person or application requiring long-term access.

Examples:

Cloud Administrator
Security Engineer
Developer
Automation Script

Best Practices:

One user per individual.
Enable MFA.
Avoid sharing accounts.
Rotate credentials regularly.

IAM Groups

Groups simplify permission management.

Example:

Developers Group

Permissions:

Read EC2
Deploy Applications
Access Development Resources

Adding a user to the group automatically grants those permissions.

IAM Roles

Roles provide temporary permissions.

Roles are commonly used by:

EC2 Instances
Lambda Functions
Cross-Account Access
AWS Services
Third-party Applications

Unlike users, roles do not have permanent passwords or access keys.

Roles are the preferred method for granting permissions to workloads.

IAM Policies

Policies define permissions.

Policies answer questions such as:

Can this user start EC2 instances?
Can this role read from S3?
Can this application access Secrets Manager?

Policies follow the principle of Least Privilege.

📜 IAM Policy Structure

A policy is written in JSON format.

Example:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": "*"
    }
  ]
}

Key fields:

Version
Statement
Effect
Action
Resource

Do not worry about writing policies yet.

You will create and review policies throughout this course.

🛡️ Principle of Least Privilege

Users should receive only the permissions required to perform their job.

Poor Practice

Developer receives:

AdministratorAccess

Good Practice

Developer receives:

Read S3
Deploy EC2
View CloudWatch Logs

Nothing more.

Benefits include:

Reduced attack surface
Lower business risk
Easier compliance
Limited lateral movement

🔑 Multi-Factor Authentication (MFA)

Passwords alone are no longer sufficient.

MFA combines two or more factors:

Something you know
Something you have
Something you are

Examples:

Password
Authenticator App
Security Key
Fingerprint

MFA significantly reduces the risk of compromised credentials.

🔄 Identity Lifecycle

Every organisation manages identities throughout their lifecycle.

Join Company
      │
      ▼
Create Identity
      │
      ▼
Assign Permissions
      │
      ▼
Regular Access Reviews
      │
      ▼
Role Changes
      │
      ▼
Permission Updates
      │
      ▼
Employee Leaves
      │
      ▼
Disable Access
      │
      ▼
Delete Identity

Identity management is an ongoing process.

🏢 Enterprise Scenario

CloudNova Technologies

A new Security Engineer joins the organisation.

They require access to:

Amazon EC2
CloudTrail
AWS Config
Security Hub
Amazon S3

They should not have permission to:

Delete IAM Users
Remove Security Logs
Delete Production Resources
Disable CloudTrail

As the Cloud Security Engineer:

Should you create a new IAM User?
Which IAM Group should they join?
What permissions should they receive?
Should MFA be mandatory?
Would a role be more appropriate for any tasks?

🧪 Hands-on Exercise 1 — Explore AWS IAM

Objective

Become familiar with the IAM console.

Steps

Sign in to the AWS Management Console.
Search for IAM.
Explore the following sections:
- Dashboard
- Users
- Groups
- Roles
- Policies
- Identity Center (if available)

Questions:

How many IAM users exist?
Which groups have been created?
How many roles are available?
Why are roles different from users?

🧪 Hands-on Exercise 2 — Enable MFA

Objective

Secure your AWS account.

Steps

Open IAM.
Select your user.
Choose Security Credentials.
Configure Multi-Factor Authentication.
Test the sign-in process.

Questions:

What happens if your password is stolen?
How does MFA reduce risk?

🧪 Hands-on Exercise 3 — Review AWS Managed Policies

Navigate to:

IAM → Policies

Review policies such as:

ReadOnlyAccess
AdministratorAccess
SecurityAudit
PowerUserAccess

Questions:

Which policy grants the most permissions?
Why should AdministratorAccess be used sparingly?
Which policy is appropriate for auditors?

🧪 Hands-on Exercise 4 — Create an IAM Group

Objective

Understand permission inheritance.

Steps

Navigate to IAM → User Groups.
Select Create Group.
Name the group:

Developers

Attach the ReadOnlyAccess policy.
Review the permissions before creating the group.

Questions:

Why assign permissions to groups instead of individual users?
How does this simplify administration?

🧪 Hands-on Exercise 5 — Analyse IAM Permissions

Review the following users:

User	Current Permissions
Alice	AdministratorAccess
Bob	ReadOnlyAccess
Charlie	SecurityAudit
David	PowerUserAccess

Answer:

Who has the highest risk?
Who follows Least Privilege?
Which permissions would you modify?
Why?

📊 Knowledge Check

Answer the following questions:

What is IAM?
What is the difference between authentication and authorisation?
What is an IAM User?
What is an IAM Group?
What is an IAM Role?
What is an IAM Policy?
Why is Least Privilege important?
Why should MFA always be enabled?
When should IAM Roles be preferred over IAM Users?

📝 Assignment

Prepare an Identity & Access Review Report for CloudNova Technologies.

Include:

Explanation of IAM.
Authentication vs Authorisation.
IAM Users, Groups, Roles and Policies.
Benefits of Least Privilege.
MFA recommendations.
Risks associated with excessive permissions.
Recommendations for improving the organisation’s identity security.

Length: 2–3 pages.

💡 Key Takeaways

After completing this lesson, you should understand:

Identity is the foundation of cloud security.
Authentication verifies identity; authorisation determines permissions.
IAM Users, Groups, Roles and Policies work together to control access.
Least Privilege reduces risk and limits the impact of compromised accounts.
MFA is one of the simplest and most effective security controls.
Secure identity management is essential for protecting cloud environments.

📚 Further Reading

AWS IAM User Guide
AWS IAM Best Practices
AWS IAM Identity Center Documentation
AWS Security Best Practices
NIST Digital Identity Guidelines (SP 800-63)

🚀 Next Lesson

➡️ Networking Fundamentals