1. IAM identities #
Users, groups, roles.
Vocabulary #
| Notion | Usage | Good practice |
|---|---|---|
| IAM user | Permanent identity with a password or keys | To avoid for humans: prefer Identity Center |
| Group | Grouping users to attach policies to them | Never attach a policy directly to a user |
| Role | Identity assumed temporarily (person, service, other account) | The default solution for applications |
| Policy | JSON document that allows or denies actions | Least privilege, conditions |
Humans and applications #
2. Policies #
The JSON document that grants rights.
Anatomy of a policy #
{
"Version": "2012-10-17",
"Statement": [{
"Sid": "LectureRapports",
"Effect": "Allow",
"Action": ["s3:GetObject", "s3:ListBucket"],
"Resource": ["arn:aws:s3:::rapports-prod", "arn:aws:s3:::rapports-prod/*"],
"Condition": { "Bool": { "aws:SecureTransport": "true" } }
}]
}Each statement specifies an effect (Allow or Deny), actions, resources (ARNs) and optionally conditions (source IP, MFA, tags, encryption in transit).
Evaluation #
aws iam simulate-principal-policy \
--policy-source-arn arn:aws:iam::123456789012:role/app \
--action-names s3:GetObject --resource-arns arn:aws:s3:::rapports-prod/janvier.pdf3. Best practices #
Least privilege in practice.
Rules #
- MFA for all humans, root user locked down.
- Identity Center and roles: no long-lived access keys on workstations or in code.
- Start from AWS managed policies to explore, then write fine-tuned policies; IAM Access Analyzer suggests policies based on actual activity.
- Separate accounts per environment and set SCPs (forbid disabling CloudTrail, limit regions).
- Regularly review unused access (last accessed in the IAM console).
aws iam generate-credential-report && aws iam get-credential-report --query Content --output text | base64 -d | head
aws accessanalyzer list-findings --analyzer-arn <arn>