Command Palette

Search for a command to run...

Hectal
Phase 1Beginner2 of 9 in AWS

IAM — Who Can Do What

Users, groups, roles, and policies — the permission system every other AWS service depends on, and the one most real breaches trace back to.

Every single AWS API call — launching an instance, reading an S3 object, invoking a Lambda — is checked against IAM first. Get IAM wrong and nothing else you build is secure, no matter how well-designed. This phase covers how identities are represented, how policies are evaluated, why roles (not long-lived keys) are how production workloads should authenticate, and how to actually practice least privilege without grinding every deploy to a halt.

0/4 · 0%
4 topics ~54 min 13 code blocks & diagrams
Start with the first topic
1
1.1

Users, Groups & Policies

An IAM user is an identity, a group is a way to attach the same permissions to many users at once, and a policy is a JSON document that says exactly which actions are allowed or denied on which resources.

13 min 1 diagram 2 code practice

2
1.2

Roles & AssumeRole

A role is an identity with no permanent credentials — anything allowed to 'assume' it receives short-lived temporary credentials instead, which is how EC2 instances, Lambda functions, CI pipelines, and other accounts should authenticate.

14 min 1 diagram 3 code practice

3
1.3

Identity-Based vs Resource-Based Policies

Identity-based policies attach to a user/group/role and say what that identity can do; resource-based policies attach to a resource like an S3 bucket or SQS queue and say who can touch it — and cross-account access usually needs both sides to agree.

13 min 1 diagram 2 code practice

4
1.4

STS, MFA & Least Privilege in Practice

STS is the service that hands out every temporary credential in AWS; MFA conditions and OIDC federation let humans and CI pipelines use those temporary credentials instead of static keys; and least privilege is a process you iterate on with real access data, not a policy you get right on day one.

14 min 3 code practice