6.2.1. Key Concepts Review: IAM & Access Control

First Principle: IAM provides granular, least privilege access control over all AWS resources, ensuring secure management of user identities, application access, and centralized governance across multiple accounts.

This review consolidates core IAM and access control concepts.

Core IAM & Access Control Concepts:

• IAM Identities: Users (human, long-term), Groups (collections of users), Roles (temporary for services or users).
• IAM Policy Types:
  • Identity-Based: Attached to identity.
  • Resource-Based: Attached to resource.
  • Service Control Policies (SCPs): Max permissions for accounts/OUs.
  • Permissions Boundaries: Max permissions for identities.
• IAM Policy Evaluation Logic: Explicit Deny overrides Allow.
• Federation & SSO: IAM Identity Center for centralized access using external identities.
• Multi-Account Strategies: AWS Organizations, AWS Control Tower for governance.
• Cross-Account Access: Via IAM Roles and AWS STS.
• Advanced Best Practices: Auditing IAM (Access Analyzer, Credential Report), Automating Credential Rotation, Condition Keys, Attribute-Based Access Control (ABAC).

Scenario: You need to design a secure access model for a large enterprise with multiple AWS accounts, granting varying levels of access to human users and applications while ensuring compliance.

Reflection Question: How do IAM identities (Users, Roles), policy types, and advanced concepts like federation and SCPs fundamentally enable granular, least privilege access control and centralized governance for secure management of AWS resources?