AWS IAM
Also known as: AWS Identity and Access Management
Following adds this technology to your private workspace so related learning is easier to organise and revisit.
What is AWS IAM?
AWS Identity and Access Management controls authentication and authorisation for identities and resources in AWS accounts. This profile connects the concept to KBY's practical engineering guidance.
IAM evaluates identity policies, resource policies, permission boundaries, service control policies and session constraints to decide whether an API action is allowed. Users, roles and federated sessions should receive temporary, least-privilege access rather than long-lived broad credentials.
Define and enforce who or what may perform actions against AWS resources.
- Managing user access to AWS resources
- Enforcing least privilege
- Configuring cross-account access
Explore related technologies
Parent technology
Diagnose and connect AWS IAM
Exact failure lookups, verified technology boundaries and reusable operational artifacts.
6 resources for AWS IAM
Browse by purpose, from definitions and learning through operations, diagnostics and controlled recovery.
Learn and operate with AWS IAM
Ordered as a reader progression -- from core definitions through to operational reference -- using only the content already connected in the technology registry.
Lexicon Definitions(1)
Start here: understand the core vocabulary.
Config Traps(4)
Recognise and avoid known failure modes.
- IAM NotResource Allow Grants Access Beyond the Tested S3 BucketA deceptive AWS IAM NotResource-plus-Allow statement grants access to every bucket except the one used for testing. Diagnose, correct and roll back safely. Open
- Wildcard Principal in IAM Trust Policies: The Open DoorAn IAM role trust policy with Principal set to a wildcard or an unscoped account root lets any AWS account, not just the intended partner, call sts:AssumeRole. Standard resource-based deny rules and SCPs on the target account rarely inspect who is calling from outside, so the exposure survives every internal review. Open
- Lambda PassRole Wildcards Build Their Own Admin RoleA Lambda execution role granting iam:PassRole on Resource: "*" without an iam:PassedToService condition lets compromised function code pass any account role to EC2, ECS, or Glue. Attackers with mere code execution pivot straight to AdministratorAccess-level compute, and CloudTrail logs look like routine service calls. Open
- NotAction Plus Allow: IAM's Silent Escalation PathAn IAM policy pairing Effect: Allow with NotAction grants every action AWS has not explicitly listed, not just the excluded services. The bound role can call sts:AssumeRole, lambda:UpdateFunctionCode, and ec2:RunInstances to escalate privileges, and the exposed surface silently grows as AWS ships new API actions each quarter. Open
Incident Runbooks(1)
Stabilise, recover and validate during incidents.