AWS Identity and Access Management

IAM

Introduction to IAM -

AWS identity and management is a web service that helps you to securely control access to AWS resources
You use IAM to control who is authenticated and authorized to use resources
IAM allows you to create and manage AWS users and groups, and use permissions to allow or deny their access to AWS resources
IAM is a fundamental part of AWS security, as it allows you to implement the principle of least privilege, ensuring that users and applications have only the permissions they need to perform their tasks
IAM also provides features such as multi-factor authentication (MFA), password policies, and access keys to enhance the security of your AWS environment

Features of IAM -

IAM User -
IAM allows you to create and manage users in your AWS account
Each IAM user has a unique name and security credentials, which are used to authenticate and authorize their access to AWS resources
IAM users have security credentials that are used for authentication and authorization. These credentials include:
Password: IAM users can have a password for logging in to the AWS Management Console.
Access Key ID and secret Access Key: IAM users can also have access keys, which are used for programmatic access to AWS services
No permissions by default. Nothing is allowed.

Groups allow you to organize users and manage their permissions collectively. Instead of assigning permissions to individual users, you can assign permissions to groups and then add users to those groups
Using groups simplifies the process of managing permissions, especially in large organizations with many users. Instead of managing permissions for each user individually, you can manage permissions for groups of users who have similar roles or responsibilities
For example, you could create a group called "Developers" and assign permissions to that group that allow members to access development resources. You can then add users to the "Developers" group as needed, and they will inherit the permissions assigned to that group

IAM Policies
Policies are JSON (Java Script Object Orientaion) documents which mention what an user or group can do on AWS recources
It defines the authorization paradigm for AWS resources
It contains 3 components at least (EAR)

IAM Roles -
Role is similar to an user/groups which has permissions/policies attached to it
Roles are temporary access given to anyone who needs to perform specific task mentioned in the role
permissions attached to the users are taken away till the time role is getting used

Multi-Factor Authentication (MFA) -
IAM supports multi-factor authentication, adding an extra layer of security to your AWS account
You can require users to provide an additional authentication factor, such as a code from a hardware token or a mobile app, in addition to their password
Users can choose between a virtual MFA device (e.g., Google Authenticator) or a hardware MFA device (e.g., YubiKey)

Identity Federation -
Identity federation in AWS IAM allows you to grant temporary access to AWS resources to users who are authenticated by an external identity provider (IdP). This enables you to use your existing identity management system to manage access to AWS resources, without requiring users to have AWS-specific credentials
SAML identity federation (security assertion mark of language)
Register AWS corporate idp (LDAP)
that will generate metadata XML
create a SAML Identity provider with SAML metadata
create roles
these roles should be mapped with organizations assertation

script "principal" : {"AWS" : "ARN of SAML provider}

"Actions" : "sts :AssumeRoleWithSAML"

Thats all for IAM guyss please email if you have any corrections, additions, queries or to discuss something about above points. EMAIl - mahajanrohit759@gmail.com
Please share it with your friends