IAM Concepts
| Concept | Description |
|---|---|
| User | A person or service with long-term credentials |
| Group | Collection of users sharing the same policies |
| Role | Temporary credentials assumed by AWS services or users |
| Policy | JSON document defining allowed/denied actions |
The Principle of Least Privilege
Grant only the permissions needed — nothing more. Start with read-only, add write access only when required.
IAM Policies
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::my-app-bucket/*"
},
{
"Effect": "Deny",
"Action": "s3:DeleteObject",
"Resource": "*"
}
]
}IAM Roles for EC2
Instead of giving an EC2 instance an access key, attach an IAM role:
# Create a role for EC2 to read from S3
aws iam create-role \
--role-name EC2ReadS3 \
--assume-role-policy-document file://ec2-trust.json
aws iam attach-role-policy \
--role-name EC2ReadS3 \
--policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccessThe instance automatically gets temporary credentials — no key files needed.
Securing the Root Account
- Enable MFA on the root account immediately.
- Never use the root account for daily tasks.
- Create an admin IAM user for administration.
- Set up billing alerts in CloudWatch.
AWS Secrets Manager
Store database passwords and API keys securely:
# Store a secret
aws secretsmanager create-secret \
--name prod/myapp/db-password \
--secret-string "s3cur3P@ss!"
# Retrieve in your app
aws secretsmanager get-secret-value \
--secret-id prod/myapp/db-password \
--query SecretString \
--output textRotate secrets automatically using Secrets Manager's built-in rotation. Never store plaintext credentials in environment variables, config files, or code.