Lesson 02 — Introduction to AWS Identity & Access Management (IAM)

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 02 – Identity & Access Management (IAM)

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Explain what AWS IAM is.
Understand how IAM secures AWS resources.
Differentiate Authentication and Authorization.
Understand IAM Users, Groups, Roles and Policies.
Understand how AWS evaluates access requests.
Explore the IAM Console.
Use AWS CLI to inspect IAM resources.

📚 Lesson Information

Estimated Time: 2.5 Hours

Difficulty: Beginner

Prerequisites: Module 01 Completed

Hands-on Lab: Yes

Assignment: Yes

💼 Business Value

Imagine CloudNova Technologies has over:

700 Employees
40 Developers
15 DevOps Engineers
10 Security Engineers
6 SOC Analysts
20 Consultants

Without IAM:

Everyone could access everything.
Sensitive customer data could be exposed.
Developers could accidentally delete production systems.
Compliance requirements would fail.

IAM ensures the right people have the right access at the right time.

🏢 In the Company

You have officially joined CloudNova Technologies as a Cloud Security Engineer.

Your manager assigns your first project.

“Before we deploy anything else in AWS, I want you to understand IAM. Every service we use depends on it.”

Your goal today is to understand how AWS controls access.

🌍 What is IAM?

AWS Identity and Access Management (IAM) is the service that controls who can access AWS resources and what actions they are allowed to perform.

IAM enables you to:

Create identities
Assign permissions
Control authentication
Manage authorization
Audit access
Secure AWS resources

Think of IAM as the security gatekeeper for AWS.

🏢 Real-World Analogy

Imagine an office building.

The building has:

Reception
Employee ID cards
Security Guards
Restricted Rooms
Server Room

Employees cannot simply walk into every room.

Their access depends on:

Identity
Department
Job Role
Permission

AWS IAM works the same way.

🔑 Authentication

Authentication answers one question:

Who are you?

Authentication methods include:

Username & Password
Access Keys
MFA
AWS IAM Identity Center
Temporary Credentials

Example:

Username

↓

Password

↓

MFA

↓

Verified Identity

✅ Authorization

Authorization answers another question:

What are you allowed to do?

Example

Developer

Allowed

Launch EC2
View CloudWatch
Upload to S3

Not Allowed

Delete IAM Users
Close AWS Account
Modify Billing

IAM Policies define these permissions.

🔄 Authentication vs Authorization

Authentication	Authorization
Who are you?	What can you do?
Verify identity	Verify permissions
Login	Access control
Username	IAM Policy
Password	Allow / Deny

Both are required before AWS allows an action.

🧩 IAM Components

AWS IAM consists of several core components.

IAM

│

├── Users

├── Groups

├── Roles

├── Policies

├── Identity Providers

├── MFA

└── Access Analyzer

These components work together to secure AWS environments.

👤 IAM Users

IAM Users represent individual people or applications that require long-term access.

Examples:

Rohit
Alice
Bob
Cloud Administrator

Users can have:

Passwords
Access Keys
MFA Devices
Policies

👥 IAM Groups

Groups simplify permission management.

Instead of assigning permissions to each user individually, permissions are assigned to groups.

Example

Developers

↓

EC2 Access

↓

CloudWatch Access

↓

S3 Read Access

Every developer inherits the same permissions.

🎭 IAM Roles

Roles are temporary identities.

Roles are commonly used by:

EC2
Lambda
ECS
EKS
Cross-Account Access

Roles do not have passwords.

Roles issue temporary credentials.

📜 IAM Policies

Policies are JSON documents.

They define permissions.

Example

Allow

↓

s3:GetObject

↓

Specific Bucket

Policies answer questions like:

Which service?
Which action?
Which resource?
Under what conditions?

🔒 Principle of Least Privilege

Every identity should receive only the permissions necessary to perform its job.

Example

Developer

Needs

Start EC2
Stop EC2
Read S3

Does NOT Need

Delete IAM Users
Modify Billing
Delete KMS Keys

Least Privilege reduces attack surface.

🏗 How IAM Works

User

↓

Login

↓

Authentication

↓

IAM Policy Evaluation

↓

Allowed?

↓

YES

↓

AWS Service

↓

NO

↓

Access Denied

Every AWS request follows this process.

🌍 AWS IAM Dashboard

Navigate to:

AWS Console

↓

IAM

↓

Dashboard

Review:

Users
Groups
Roles
Policies
Account Summary
Security Recommendations

Spend time becoming familiar with the interface.

🏢 Enterprise Example

CloudNova Technologies has three teams.

Security Team

Cloud Engineering

Developers

Requirements:

Security Team

Full Security Access

Cloud Engineers

Infrastructure Management

Developers

Deploy Applications

Each team requires different permissions.

Using IAM Groups and Policies makes this manageable.

🧪 Enterprise Mission 01 — Explore IAM Dashboard

Open AWS Console.

Navigate:

AWS Console

↓

IAM

Explore:

Dashboard
Users
Groups
Roles
Policies
Account Settings

Do not modify anything.

Record what each section is used for.

🧪 Enterprise Mission 02 — List IAM Users

Open PowerShell.

Run:

aws iam list-users

Questions:

How many users exist?
Who created them?
Are they still required?

🧪 Enterprise Mission 03 — List IAM Groups

aws iam list-groups

Review:

Group Names
Creation Dates

Questions:

Which departments could use groups?

🧪 Enterprise Mission 04 — List IAM Roles

aws iam list-roles

Observe:

Role Names
AssumeRole Policy
Creation Date

Question:

Why do AWS services prefer Roles over Users?

🧪 Enterprise Mission 05 — List IAM Policies

AWS Managed Policies

aws iam list-policies --scope AWS

Customer Managed Policies

aws iam list-policies --scope Local

Questions:

How many AWS Managed Policies exist?
Are any custom policies present?

🧪 Enterprise Mission 06 — View Account Summary

Run:

aws iam get-account-summary

Review:

Users
Groups
Roles
Policies
MFA Devices

Document your observations.

🧪 Enterprise Mission 07 — View Current Identity

Run:

aws sts get-caller-identity

Record:

Account ID
User ARN
IAM User

Question:

Am I using an IAM User or another type of identity?

🏢 Enterprise Challenge

CloudNova plans to hire:

120 Developers
30 Cloud Engineers
12 Security Engineers
20 Contractors
15 Auditors

Design an IAM strategy.

Questions:

Should every person receive AdministratorAccess?
How would you organise departments?
Which identities should use Roles?
Which users require MFA?

Write your recommendations.

📊 Knowledge Check

What is AWS IAM?
What is Authentication?
What is Authorization?
What is an IAM User?
What is an IAM Group?
What is an IAM Role?
What is an IAM Policy?
Why is Least Privilege important?
Which AWS CLI command lists IAM Users?
Which command shows your current identity?

📝 Assignment

Create a document titled:

AWS IAM Fundamentals

Include:

What is IAM?
Authentication vs Authorization
IAM Components
IAM Architecture Diagram
Enterprise Example
AWS CLI Commands Used
Screenshots of the IAM Dashboard
Lessons Learned

Length:

3–4 Pages

📋 Lesson Completion Checklist

Task	Status
Explored IAM Dashboard	☐
Listed IAM Users	☐
Listed IAM Groups	☐
Listed IAM Roles	☐
Listed IAM Policies	☐
Reviewed Account Summary	☐
Verified Current Identity	☐
Completed Enterprise Challenge	☐
Completed Assignment	☐

💡 Key Takeaways

After completing this lesson, you should understand:

IAM is the foundation of AWS security.
Every AWS request is authenticated and authorised.
IAM consists of Users, Groups, Roles and Policies.
Least Privilege is a core security principle.
Roles are generally preferred for AWS services because they use temporary credentials.
A well-designed IAM strategy is essential for secure enterprise cloud environments.

📚 Further Reading

AWS IAM User Guide
AWS IAM Best Practices
AWS Security Best Practices
AWS Well-Architected Framework – Security Pillar
AWS STS Documentation

🚀 Next Lesson

➡️ Lesson 03 — IAM Users