AWS IAM
Global service controlling who (identities) can do what (policies) on which AWS resources.
Verified against AWS documentation · 2026-08-27
Key facts
- 01Global, not regional — users, roles, and policies exist once per account and apply everywhere
- 02Identities: users (people), groups (bundles of users), roles (temporary credentials assumed by anyone/anything)
- 03Policies are JSON documents; evaluation rule: explicit deny > explicit allow > implicit deny (default)
- 04Roles > access keys — services (EC2, Lambda) assume roles for temporary credentials, never store keys on instances
- 05Root user: full unrestricted access; lock it down with MFA and never use it for daily work
Exam triggers
Phrases and scenarios that point here.
- "Grant EC2/Lambda access to S3" → IAM role attached to the service, never access keys in code
- "Cross-account access" → role in the target account, trust policy allowing the source account to assume it
- "Temporary credentials" or "federated access" → roles via STS, not new IAM users
- "Least privilege" → start from nothing, grant only required actions
- "Enforce MFA" / "password policy" → IAM account settings, condition keys like aws:MultiFactorAuthPresent
Not this service
- Workforce SSO across many accounts → IAM Identity Center
- Customer-facing app sign-ups and logins → Amazon Cognito
- Managed Microsoft AD → AWS Directory Service
Use cases
- 01A deploy pipeline assumes a short-lived role to push to production instead of a shared 'ci-user' with permanent keys sitting in a config file
- 02A reporting Lambda in the analytics account assumes a read-only role in the production account to pull billing data — cross-account without credential sharing
- 03New hires land in a 'developers' group and instantly inherit the team's permissions; offboarding is one group removal, not a policy audit
- 04An EC2 instance profile grants a web server write access to exactly one S3 bucket — a leaked server can't touch anything else
- 05Permissions boundary on a sandbox role lets junior engineers create resources freely but caps what any role they create can ever do
How it's charged
- 01Free — no charge for users, groups, roles, policies, or STS calls
- 02You pay only for what identities access, not for the identities themselves
- 03Related paid services are separate: IAM Identity Center is free, but Directory Service and Cognito (beyond free tier) are billed
