AWS IAM & CLI — understanding identities, permissions and best practices

IAM (Identity and Access Management)

IAM stands for Identity Access Management. It’s the AWS service that manages identities and access permissions to resources.

Root user, users and groups

When you create an AWS account, you get a root user.
It’s recommended to create dedicated users and to avoid using the root user for daily tasks.
You can also create groups to organize users together.

Policies (permissions)

Permissions are policies written in JSON. A policy can be attached to groups or to users.

Structure of a JSON policy:

Version: a date, typically 2012-10-17.
Id: the name of the policy.
Statement: the body of the policy. A policy can contain multiple statements, each with:
- Sid: the statement identifier (useful since a policy can have several statements).
- Effect: Allow or Deny.
- Principal: the user(s) targeted by the policy.
- Action: the allowed or denied actions (e.g. GetBucket, ListBucket).
- Resource: the targeted resource (e.g. the SecretPics bucket).

MFA (Multi-Factor Authentication)

MFA is strongly recommended for the root user and for IAM users.

Available options:

Authenticator app (token)
YubiKey (Yubico)
Hardware key fob (e.g. Gemalto)

[!INFO] The US government uses a hardware key fob from SecurePassID.

Ways to access AWS

There are 3 ways to access AWS:

Web console
Terminal (AWS CLI)
AWS SDK

[!INFO] The AWS SDK is a code library that lets developers easily connect and integrate their applications with Amazon’s cloud services (storage, databases, etc.) using their own programming language.

There’s also CloudShell: an online shell hosted by AWS, useful if you don’t want to install the AWS CLI locally.

Roles

You can create roles to let AWS services perform actions on your behalf (for example, granting privileges to an EC2 instance).

IAM security tools

1. Credential Report

An essential audit tool that lists all users of an AWS account along with the status of their credentials.

Function: provides information about password status, access keys, and MFA devices.
Usage: verify that only authorized identities have access to resources, and identify unused permissions to remove. A key element for regularly auditing account security.

2. Last Access (formerly Access Advisor)

Tracks the actual usage of AWS services by IAM entities (users, groups, or roles).

Function: shows the last accessed date for each service allowed by a policy.
Usage: particularly useful for applying the principle of least privilege. By identifying services that haven’t been used in a long time, you can tighten IAM policies and remove unnecessary permissions.
Scope: available at the individual account level or across the whole organization.

IAM Best Practices

[!WARNING] Don’t use the root account for everyday tasks.

1 AWS user = 1 physical person: never share your credentials with colleagues or friends.
Assign users to groups and grant permissions at the group level.
Set up a strong password policy.
Enable and enforce MFA.
Create and use roles to grant permissions to AWS services.
Use access keys for SDK and CLI access.
Regularly audit permissions with Credential Report and Last Access.
Never share your IAM users or access keys.

Summary

Users map to physical people.
Groups contain users.
Policies are JSON documents attached to users and groups.
Roles are meant for EC2 instances or AWS services.
Security relies on MFA and a solid password policy.
AWS CLI: manage AWS from the command line.
AWS SDK: manage AWS through scripts.
Access keys are used to access the SDK and CLI.
Auditing is done with Credential Report and Last Access.