AWS Made Easy | IAM Introduction
Tags: aws, cloud
Published: 2021-04-28 03:21:04

---
title: AWS Made Easy | IAM Introduction
published: true
date: 2021-02-16 18:55:36 UTC
tags: aws,aws,cloud
canonical_url: https://www.archerimagine.com/articles/aws/aws-iam-introduction.html
---

![AWS Made Easy | IAM Introduction](https://www.archerimagine.com/images/aws/IAM/AWS-made-easy-iam.png "AWS Made Easy | IAM Introduction")

## IAM Introduction[¶](#iam-introduction "Permanent link")

IAM provides the interface to join the great world of AWS. Its major goal is to provide both human and computer, who are the consumers of AWS services a way to access them.

### IAM Components[¶](#iam-components "Permanent link")

IAM service have five(5) components:-

- User - The user of AWS resource, can be a person or a machine 
- Groups - The above user can be grouped together 
- Policy - It defines the permission of the IAM identity. 
- Roles - A roles are just a policy, but not associated with the Users directly. 
- API Keys - The keys used to programmatically accessing the AWS console. 

### IAM property[¶](#iam-property "Permanent link")

AWS works on two very important principles.

- Principle of least privilege. 
  - Any user, group must be granted minimum permission to complete the activity. 
- Non explicit deny rule. 
  - We are new user have no explicit allow rule for a resource, AWS assumes it to be access denied. 
  - Only an explicit allow can override a non explicit deny rule. 

## Admin Vs root User[¶](#admin-vs-root-user "Permanent link")

### root user[¶](#root-user "Permanent link")

This is the very first user which is created when we sign-up for AWS using our emailID. This user has god like access and is not under the control of IAM.

This login must never be used for daily activities within AWS.

These 5 steps should be done as soon as we login to AWS root account.

1. Delete the root access keys.
2. Enable MFA
3. Create user
4. Create groups and assign user to groups
5. Apply an IAM password policy

### Admin user[¶](#admin-user "Permanent link")

We can create a copy of the root user with complete admin access. This is the _Admin_ user. This is user comes under the purview of IAM and should be used as a daily driver in AWS.

## Conclusion[¶](#conclusion "Permanent link")

When we login to the AWS console for the first time we create the _root_ user, this is the god like user which has all the access and have no control via the IAM policies. This user is not supposed to be used for day to day activity, in place we should be using another user called _admin_ which has all the policies similar to _root_ user but is controlled via IAM.

There are a few important steps to perform as soon as we login to the AWS console for the first time, which is to delete the programmatic access key for the root user followed by creation of users and groups. The policy to be attached to groups and user can be part of groups. There also should be a password policy specified for the users.

AWS works on 2 important principle,

1. Principle of least privilege 
2. Non explicit deny rule

This means that, all the user should be provided the bare minimum of the access required to get the job done, and if not specified, by default the user does not have access to any resources on AWS.

## Reference[¶](#reference "Permanent link")

- Photo by [Ales Nesetril](https://unsplash.com/@alesnesetril) on [Unsplash](https://unsplash.com/s/photos/technology)