> For the complete documentation index, see [llms.txt](https://ysfang82.gitbook.io/development-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ysfang82.gitbook.io/development-notes/aws-notes/service/identity-and-federation/iam.md).

# IAM

**Introduction**

* Identity and Access Management (IAM) enableing control access to AWS services and resources
* Can create and manage AWS users and groups, and use permissions to allow and deny their access to AWS resources
* A global (**Not Regional**) service

**Feature**

* Providing
  * Centralized control
  * Shared access to AWS account
  * Granular permissions
  * Identity Federation (ex. to a SAML IdP)
    * Create a SAML provider in IAM and create IAM role that establishes a trust relationship between IAM and the IdP that identifies the IdP as a principal (trust entity) for purposes of federation.
  * Multifactor Authorization (MFA)
  * Providing temporary access for users, devices, services
  * Can set up custom password policy (ex: password rotation)
  * Support PCI DSS compliance
* Composition
  * Users
    * Simply people
    * Access type:
      * Programmatically accessing AWS APIs and command line
        * Access Key ID
        * Secret Access Key (only visible when creating, can be downloaded in the crendential.csv)
      * AWS console
        * Password (only visible when creating, can be downloaded in the crendential.csv)
  * Groups
    * A collection of people applying the same permissions
  * Roles
    * Can create a role then attach it to AWS resources or users
    * If a user switches the role, original access to the user is canceled. He can only use the access of the role.
    * Service Role (ex. [attaching the role (or service role) to EC2 within instance metadata](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html))
    * [Service-linked Role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html)
  * Policies
    * A JSON document defining permissions
    * Scenarios
      * [Configure an IAM Policy that restricts access only to the user-specific folders in the Amazon S3 Bucket.](https://aws.amazon.com/blogs/security/writing-iam-policies-grant-access-to-user-specific-folders-in-an-amazon-s3-bucket/)
      * [Force tagging to AWS resources](https://aws.amazon.com/premiumsupport/knowledge-center/iam-policy-tags-restrict/) (The best way is to use AWS Catalog)
        * Can be defined either with IAM policies for a role, user or with AWS Organizations SCP for an OU / entire organization.
        * ```
                "Condition": {
                  "StringEquals": {
                    "aws:RequestTag/key1": "value1",
                    "aws:RequestTag/key2": "value2"
                  },
                  "ForAllValues:StringEquals": {
                    "aws:TagKeys": [
                      "key1",
                      "key2"
                    ]
                  }
                }
          ```
  * Trust Policy
    * A JSON document defining who can assume the role
* [Evaluaiton logics](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html)
  * Authenticates the principal. 
  * Determines which policy to apply to the request. 
  * Evaluates the policy types and arranges an order of evaluation. 
  * Processes the policies against the request context to determine if it is allowed.

![Determining whether a request is allowed or denied within an account](https://3303577320-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M4cDbT2F2VmcAohuhSN%2F-MJgfwLaYrdEt2-PgsSt%2F-MJghE8ymnnWJVf_TXmv%2FScreen%20Shot%202020-10-15%20at%2010.40.31%20PM.png?alt=media\&token=c48813cc-5589-4b66-8cb6-ffe8213ce7f6)

**Related Service**

* Access Advisor - See permissions granted and last access time
* Access Analyzer - Analyze resources that are shared with external entity