AWS IAM
#17 · Level 1 · Core services · Identity and accessConcept
Section titled “Concept”AWS IAM (Identity and Access Management) decides who can get into AWS, and what they can do once inside. Its main parts are Users (a person or an app), Groups (a team of Users) and Roles (permissions that can be taken on temporarily). What is and isn’t allowed is written in rule documents called Policies. Services such as EC2 or Lambda also take on a Role to get permission to use other services. IAM is global for the whole account, not tied to a specific Region.
Simple example
Section titled “Simple example”An office ID card system. Every employee has their own card. An accounts staff member’s card opens only the accounts room, and an IT staff member’s card opens the server room. Not every card opens every door.
Why it’s needed
Section titled “Why it’s needed”If everyone has every power, big damage can happen by mistake or on purpose. Each person should get exactly the permissions they need, and no more.
Where it’s used
Section titled “Where it’s used”Everyone on a team has their own login. Roles are used to give an app or a server permission to use other services.
Key terms
Section titled “Key terms”| English | Simple meaning |
|---|---|
| User | The login of one person or app |
| Group | A team of people who do the same work |
| Role | Temporary permission, for example letting a server read from S3 |
| Policy | Written rules about what is and isn’t allowed |
Azure equivalent
Section titled “Azure equivalent”Microsoft Entra ID + Azure RBAC
Related
Section titled “Related”AWS IAM Identity Center · AWS Organizations
Learn more
Section titled “Learn more”For details and the latest information, see the official documentation: