# AWS IAM

> AWS Identity and Access Management (IAM) is a web service provided by Amazon Web Services (AWS) that enables users to securely control access to AWS…

- Source: https://www.itwonderlab.com/aws-iam/
- Published: 2024-01-11
- Updated: 2026-10-05
- Author: Javier Ruiz Jiménez (https://www.javierruizjimenez.com/)
- Site: IT Wonder Lab (https://www.itwonderlab.com/)

---

## Identity and Access Management (IAM)

AWS Identity and Access Management (IAM) is a web service provided by Amazon Web Services (AWS) that enables users to securely control access to AWS services and resources. IAM allows administrators to manage users, groups, roles, and permissions within their AWS accounts, ensuring secure and fine-grained control over who can perform specific actions and access particular resources.

### Users

IAM allows you to [create individual IAM users](https://www.itwonderlab.com/terraform-aws-iam-users/) for individuals in the organization. Each user has unique security credentials (a password for the console and, optionally, access keys) and specific permissions.

> [!TIP]
> Long-lived access keys are a risk. Prefer roles with temporary credentials, [IAM Identity Center](https://aws.amazon.com/iam/identity-center/) for people and OpenID Connect for pipelines, as in [Terraform CI/CD](https://www.itwonderlab.com/aws-terraform-tutorial-terraform-cicd/).

-   See [Create an AWS IAM User for Demos](https://www.itwonderlab.com/create-an-aws-iam-user-for-demos/).

### Groups

Users can be organized into groups, and permissions can be assigned to groups rather than individual users. This simplifies access management by applying permissions to a group and then adding users to that group.

### Roles

IAM roles define a set of permissions for making AWS service requests. Roles are not associated with a specific user or group but can be assumed by users, applications, or AWS services.

### Policies

Policies are JSON documents that define the permissions granted to users, groups, or roles. Policies specify the actions allowed or denied on AWS resources and are attached to IAM entities to control their access.

### Permissions

IAM enables fine-grained permissions by specifying what actions are allowed or denied on specific AWS resources. This allows for the principle of **least privilege**, where users and roles have only the permissions they need to perform their tasks.

### Access Key and Secret Key

IAM users are provided with an access key and secret key pairs for programmatic access to AWS services through the AWS Command Line Interface (CLI) or SDKs. These keys should be kept secure and are used for making API calls.

-   See [How to Create AWS IAM users with Terraform & OpenTofu](https://www.itwonderlab.com/terraform-aws-iam-users/).

### Multi-Factor Authentication (MFA)

IAM supports the use of multi-factor authentication for an extra layer of security. Users can be required to provide a time-based, one-time password in addition to their regular credentials.

### Identity Federation

IAM supports identity federation, allowing users to use their existing corporate credentials to access AWS resources. This is achieved through integration with identity providers using standards like SAML (Security Assertion Markup Language).

### AWS Organizations

IAM integrates with [AWS Organizations](https://www.itwonderlab.com/aws-organizations/), allowing administrators to create and manage a hierarchical structure of AWS accounts. This simplifies the management of permissions and resource sharing across accounts.

### Audit and Logging

IAM provides audit and logging capabilities, including [AWS CloudTrail](https://www.itwonderlab.com/aws-cloudtrail/) integration, to track user activity and changes to permissions. This helps in monitoring and maintaining security compliance.

AWS IAM is a fundamental component of AWS security, enabling users to control access to resources securely and manage identities within the AWS environment. It is essential for implementing security best practices and ensuring a robust and compliant AWS infrastructure.

### With Terraform

The resources include `aws_iam_user`, `aws_iam_role`, `aws_iam_policy`, `aws_iam_role_policy_attachment`, `aws_iam_instance_profile` and the data source `aws_iam_policy_document`, which builds policies in HCL instead of JSON strings.