📅 Day 12 | AWS IAM — The Backbone of AWS Security 🔐☁️

Source: Dev.to

What is IAM?

IAM (Identity and Access Management) is the security system of AWS.
It decides who can access what in your AWS account.

Think of IAM like a security guard:

• Users – People who need access
• Roles – Permissions for AWS services (EC2, Lambda, GitHub Actions, Terraform)
• Policies – Rules that say what actions are allowed
• Groups – Team permissions

How to Use IAM (Step‑by‑Step Guide)

1. Create IAM Users (for people)

Use users for human access, not automation.

Steps

1. Go to AWS Console → IAM → Users
2. Click Create user
3. Provide a name (e.g., devops-user)
4. Attach permissions (Admin or custom)
5. Create login credentials
6. Enable MFA (very important!)

Purpose: Logging into AWS as a person.

2. Create Groups (for teams)

Groups help give the same permissions to multiple users.

Examples

• DevOps‑Team
• Developers
• Admin‑Team

Steps

1. IAM → User groups → Create group
2. Attach common policies
3. Add users to the group

3. Create IAM Roles (for AWS services)

Roles are used by machines, not humans.

Examples

• EC2 instance role
• Lambda execution role
• GitHub Actions OIDC role
• Jenkins role
• Terraform role

Steps

1. IAM → Roles → Create role
2. Choose a service (EC2, Lambda, etc.)
3. Attach policies (S3, EC2, CloudWatch, …)
4. Attach the role to the service

Use Cases

• EC2 can read S3 objects using a role
• GitHub Actions deploys to AWS using a role (no access keys)

4. Attach Policies (Permissions)

A policy is a JSON document that defines allowed actions.

Example Policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::mybucket/*"
    }
  ]
}

Steps

1. IAM → Policies → Create policy
2. Attach the policy to a user, group, or role

5. Enable MFA (for security)

MFA adds strong protection during login.

Steps

1. IAM → Users → Your user → Security credentials
2. Click Assign MFA device
3. Scan the QR code with Google Authenticator / Authy
4. Finish the setup

6. Use IAM Access Analyzer

IAM Access Analyzer identifies security risks such as public S3 buckets or over‑permissive policies.

Steps

1. IAM → Access Analyzer
2. Enable an analyzer
3. Review findings
4. Fix over‑permissive policies

Where IAM is Used in DevOps

Useful Links

• GitHub:
• Dev.to Blog:
• LinkedIn:
• Resume (Google Drive):