IAM

Policies inheritance

  • The policies can be inherited from group of policy and inline policy of individual

Policy Structure

  • Effect: Allow or Deny

  • Principal: The target user

  • Resource: The permission of resource

Access Token

  • For applying policy into code, it is needed to include aws sdk and access token for the user

  • For logging in by aws cli, it is needed to use access token

Organization

  • Allow to manage multiple accounts

  • Enable to use cloud trail on all accounts

  • Secure Control Policies (SCP) can be applied to Organization unit or account to restrict user

  • The Policies will be inherited from upper level

Identity-Based Vs Resource-Based Policies

Identity-based

  • Identity-based policies are associated with IAM identities, such as IAM users, IAM groups, or IAM roles.

  • They are the primary method for granting permissions to IAM users, groups, or roles within your AWS account.

  • Identity-based policies define what actions an identity can perform on AWS resources and under what conditions.

Resource-based

  • Resource-based policies are associated with AWS resources themselves, such as Amazon S3 buckets, AWS KMS keys, AWS Lambda functions, etc.

  • They allow you to define who (which IAM identities or AWS accounts) has access to the resource and what actions they can perform on it.

  • Resource-based policies grant permissions to other identities or accounts to access and interact with the specific resource.

  • These policies are created and managed within the service that owns the resource (e.g., S3, KMS, Lambda) and are attached directly to the resource itself.

  • Resource-based policies are a way to share access to resources with other AWS accounts or IAM entities without modifying their identity-based policies.

Identity Center

  • One login for all accounts

  • Assign permission sets to the users to have a role / permission to the accounts

Directory Service

  • Microsoft Active Directory is a service that can centralize security management, create account, assign permission

Control Tower

  • Easy way to setup a secure and compliant multi-account AWS environment

  • user AWS Organization to create accounts

PreviousNetworkNextRole-Service Binding

Last updated

Was this helpful?