managing-iam-credentials.md

Managing IAM Credentials

Building Blocks of IAM

• IAM is universal - does not apply to a specific region

Users

• A physical person
• Users have no permissions when first created

Groups

• Contains users
• Users should inherit permissions from groups
• Based on job functions
  • Developer
  • Administrator
• IAM policy documents should be applied to groups, not users

Roles

• Internal to AWS
• Allows one AWS resource to access another AWS resouce

Principle of Least Privilege

• Only assign a user the minimm amount of privileges they need to do their job

Access Types

• Access Key/Secret Access Key

  • Provides programmatic access to the AWS API, CLI, SDK and other development tools
  • Not the same as username and password
  • Only get to view these when the user is created.
  • If you lose them, you will need to regenerate them, so save them in a secure location.

• Password

  • Enables a user to use a password to login to the AWS console

Passwords

• You can create and customize password rotation policies

IAM Federation

• Using an existing user account and credentials (usually Active Directory) to login to AWS.

Identity Federation

• Uses SAML standard (Active Directory)