AWS IAM
Also known as: AWS Identity and Access Management
Following adds this technology to your private workspace so related learning is easier to organise and revisit.
What is AWS IAM?
AWS Identity and Access Management controls authentication and authorisation for identities and resources in AWS accounts. This profile connects the concept to KBY's practical engineering guidance.
IAM evaluates identity policies, resource policies, permission boundaries, service control policies and session constraints to decide whether an API action is allowed. Users, roles and federated sessions should receive temporary, least-privilege access rather than long-lived broad credentials.
Define and enforce who or what may perform actions against AWS resources.
- Managing user access to AWS resources
- Enforcing least privilege
- Configuring cross-account access
Explore related technologies
Parent technology
6 resources for AWS IAM
Browse by purpose, from definitions and learning through operations, diagnostics and controlled recovery.
Learn and operate with AWS IAM
Ordered as a reader progression -- from core definitions through to operational reference -- using only the content already connected in the technology registry.
Config Traps(4)
Recognise and avoid known failure modes.
- IAM NotResource Allow Grants Access Beyond the Tested S3 BucketA deceptive AWS IAM NotResource-plus-Allow statement grants access to every bucket except the one used for testing. Diagnose, correct and roll back safely. Open
- Wildcard Principal in IAM Trust Policies: The Open DoorAn IAM role trust policy with Principal set to a wildcard or an unscoped account root lets any AWS account, not just the intended partner, call sts:AssumeRole. Standard resource-based deny rules and SCPs on the target account rarely inspect who is calling from outside, so the exposure survives every internal review. Open
- Lambda PassRole Wildcards Build Their Own Admin RoleA Lambda execution role granting iam:PassRole on Resource: "*" without an iam:PassedToService condition lets compromised function code pass any account role to EC2, ECS, or Glue. Attackers with mere code execution pivot straight to AdministratorAccess-level compute, and CloudTrail logs look like routine service calls. Open
- NotAction Plus Allow: IAM's Silent Escalation PathAn IAM policy pairing Effect: Allow with NotAction grants every action AWS has not explicitly listed, not just the excluded services. The bound role can call sts:AssumeRole, lambda:UpdateFunctionCode, and ec2:RunInstances to escalate privileges, and the exposed surface silently grows as AWS ships new API actions each quarter. Open
Incident Runbooks(2)
Stabilise, recover and validate during incidents.
- Wildcard iam:PassRole Escalates via Lambda UpdateFunctionAn IAM policy granting iam:PassRole with Resource: "*" and no iam:PassedToService condition lets any principal holding lambda:UpdateFunctionConfiguration reassign an existing function's execution role to AdministratorAccess, then invoke that function to harvest privileged temporary credentials from the runtime's local metadata endpoint. Open
- When StringLike Wildcards Defeat sts:ExternalId ChecksWhen a cross-account IAM trust policy uses StringLike on sts:ExternalId with value "*", the condition becomes a no-op that matches any string. Because the Principal is scoped to the vendor's shared account rather than per-tenant, any customer can supply an arbitrary ExternalId and successfully assume role bindings belonging to other tenants, collapsing SaaS tenant isolation and exposing cross-customer data access. Open