IAM & Access Management
Difficulty: easy
Overview
AWS Identity and Access Management (IAM) is a global service that controls authentication (who you are) and authorization (what you can do) for all AWS resources.
Core IAM Components:
- Root Account — Created when you first sign up for AWS. Has unrestricted access. Should be protected with MFA and never used for daily tasks. Only tasks that require root: close the account, change support plan, change payment method, restore IAM admin access.
- IAM Users — Individual identities with long-term credentials (password + access keys). For humans or legacy apps.
- IAM Groups — Collections of users that share policies. You cannot nest groups. Simplifies bulk permission management.
- IAM Roles — Assumed by AWS services (EC2, Lambda), federated users, or other accounts. Provide temporary credentials via STS — no long-term keys stored.
- IAM Policies — JSON documents defining permissions (Effect: Allow/Deny, Action, Resource).
Best Practices:
- Enable MFA on root account immediately.
- Follow the principle of least privilege — grant only minimum required permissions.
- Use IAM roles (not users) for EC2, Lambda, ECS.
- Never share credentials; never use root for daily tasks.
- Rotate access keys regularly; prefer roles over long-term access keys.
IAM Identity Center (formerly AWS SSO) — Centrally manage SSO access to multiple AWS accounts and business applications.
Service Control Policies (SCPs) — Applied at AWS Organizations level; define the maximum permissions available in accounts. An SCP deny overrides any IAM allow.
Policy Evaluation: Explicit Deny always wins → SCP → resource-based policy → identity-based policy → permission boundary.
Practice Linked Questions
Q1. What is the AWS root account user?
Select one answer before revealing.
Q2. What is the AWS recommended best practice for securing the root account?
Select one answer before revealing.
Q3. What is the principle of least privilege in AWS IAM?
Select one answer before revealing.
Q4. A company has 50 developers who all need the same S3 read permissions. What is the MOST efficient IAM approach?
Select one answer before revealing.
Q5. What is the key difference between an IAM user and an IAM role?
Select one answer before revealing.
Q6. An application running on EC2 needs to write to an S3 bucket. What is the MOST secure way to provide this access?
Select one answer before revealing.
Q7. A company uses AWS Organizations and wants to prevent all accounts in a specific OU from launching resources in the eu-west-1 region. Which feature enables this?
Select one answer before revealing.
Q8. Which TWO actions can ONLY be performed by the AWS root account user and cannot be delegated to IAM users or roles? (Select TWO — more than one answer may be correct)
Select one answer before revealing.
Q9. What does enabling MFA (Multi-Factor Authentication) on an AWS account add to security?
Select one answer before revealing.