Thuta Learning
Search
BasicDevOpsbeginner

IAM Basics (Identity & Access Management)

Relax. We'll talk through this in plain words — no textbook voice.

What you'll walk away with

  • Understand IAM Basics (Identity & Access Management) without the intimidation
  • Be able to run the AWS CLI/Console yourself
  • Apply this concept immediately in a real project

Let's think about this for a second

An IAM User represents an identity created inside an AWS account (a developer, or an application) — it authenticates with a username/password or an access key. An IAM Group lets you organize users into logical groups (for example, 'developers', 'admins') so you can assign permissions at the group level all at once. An IAM Policy is a permission document (in JSON format) describing 'what's allowed to do what to which resource' — you attach one or more policies to a user/group. The best practice here is 'least privilege' — the principle of granting only the permissions that are actually needed.

Let's connect this to a real scenario

When a new developer joins the team — if the IAM Group 'developers' already has EC2/S3 permissions attached (without production database permissions), all you need to do is create a User for the new developer and add them to the group, and the right permissions are set instantly — no need to manually attach policies to each user one by one.

Let's look at it together

json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:ListBucket"],
      "Resource": ["arn:aws:s3:::my-tutorial-bucket", "arn:aws:s3:::my-tutorial-bucket/*"]
    }
  ]
}
You should see
$ (AWS Console) IAM > Users > developer-1: attached policies: [S3ReadOnlyTutorial]

5-minute try-it

Create an IAM User (in your own practice account) and attach a policy that grants S3 read-only permission — confirm the permission in the console.

A quick word of caution

If an IAM access key ever gets committed to a public repository (even by accident), bots and attackers can find it within minutes and misuse it — if a leak happens, deactivate/rotate the access key immediately.

Easy traps

  • Attaching the AdministratorAccess policy (every permission) to an IAM User meant for an application/script — if the application is compromised, the blast radius gets much bigger
  • Hardcoding an IAM User's access key in code and committing it to git — this leaks far more often than you'd expect

Now try it yourself

Create an IAM User (in your own practice account) and attach a policy that grants S3 read-only permission — confirm the permission in the console.

You'll know it worked when: $ (AWS Console) IAM > Users > developer-1: attached policies: [S3ReadOnlyTutorial]

IAM Basics (Identity & Access Management) | Thuta Learning