4.1.1. IAM for Resource Access (Users, Groups, Roles, Policies)

💡 First Principle: IAM provides granular control over who can access AWS resources and perform operational tasks, ensuring secure and auditable management of your cloud environment.

Scenario: You need to grant a new SysOps Administrator access to stop and start EC2 instances in the development environment and read-only access to CloudWatch metrics for all environments. You also need to grant an EC2 instance permission to write logs to CloudWatch Logs.

For SysOps Administrators, effectively configuring AWS Identity and Access Management (IAM) is fundamental to securing the AWS environment. IAM allows you to manage access to AWS services and resources securely.

Key IAM Components for Operational Access:

• IAM Users: (Individual entities (people or applications) with long-term credentials for direct AWS interaction.) For SysOps Administrators who directly log into the AWS Management Console or use the AWS CLI. Always secure with Multi-Factor Authentication (MFA).
• IAM Groups: (Collections of IAM users.) Simplifies permission management by attaching policies to a group (e.g., "SysOpsAdmins"), granting the same permissions to all users within it.
• IAM Roles: (Secure IAM identities that grant temporary permissions to AWS services or trusted users.) Used by automated AWS services (e.g., an EC2 instance accessing S3 via an instance profile, a Lambda function executing code). Also used for cross-account access and federated access.
• IAM Policies: (JSON documents that define specific permissions.) Attached to users, groups, or roles to enforce access control. Adhere strictly to the Principle of Least Privilege.

⚠️ Common Pitfall: Attaching AWS managed policies like AdministratorAccess to users or roles when more granular permissions are sufficient.

Key Trade-Offs: Granular, least-privilege policies (more secure, but more complex to create and manage) versus broader policies (less secure, simpler).

Reflection Question: How does configuring IAM users within an IAM Group (for human access) and assigning IAM Roles (for machine access) with narrowly scoped IAM Policies fundamentally ensure secure and auditable management of AWS resources for operational tasks?