AWS Identity and Access Management

Core security service that controls who is allowed to perform which actions on AWS.

Service for managing access to AWS resources. Uses users, groups, roles, and policies to control who can do what.

• Managing permissions for administrators and developers
• Managing execution roles for Lambda and EC2
• Designing least-privilege policies

• Avoid daily use of the root user
• Enable MFA on IAM users
• IAM roles delegate permissions to AWS services or federated identities

• When applications access AWS services, use IAM roles instead of embedding access keys
• Scope permissions by Action and Resource
• Understand trust policies for cross-account access

AWS Identity and Access Management (IAM) is a service for authenticating and authorizing access to AWS resources. By combining the four elements of IAM users, IAM groups, IAM roles, and IAM policies, it controls "who is allowed to perform which operations against which AWS resources". IAM policies are written in JSON and specify Action (API operations to allow or deny), Resource (target resources), and Condition (additional conditions). IAM roles are a mechanism for delegating permissions not directly to IAM users but to AWS services (EC2, Lambda, etc.), other AWS accounts, or external identity federation (SAML / OIDC). For example, when a Lambda function writes an object to S3, instead of hard-coding access keys in the function, you assign an IAM role with PutObject permission for S3 to the Lambda. This reduces the risk of access key leakage and also lowers the operational burden of key rotation. In CLF-C02, frequent topics include the differences between the root user and IAM users, the importance of MFA, the principle of least privilege, and permission delegation via IAM roles. From SAA-C03 onward, more advanced design topics are asked, such as designing trust policies for cross-account access, the priority among IAM policies and S3 bucket policies / KMS key policies, and organization-wide single sign-on using IAM Identity Center. IAM itself incurs no additional charges, but permission mistakes can lead to unintended resource creation or unintended API calls that result in billing incidents, so the importance of operational design is high.

• What is AWS Identity and Access Management (AWS Official Documentation)
• IAM Roles (AWS Official Documentation)
• IAM Security Best Practices (AWS Official Documentation)

Last updated: 2026-06-01