AWS IAM Master Cheatsheet: Identity & Access Management Essentials

Introduction: Why IAM Is Your AWS Security Foundation

AWS Identity and Access Management (IAM) is the control system for your entire AWS infrastructure, governing who can access what resources and how. Proper IAM configuration is critical for security, compliance, and operational efficiency. IAM operates on the principle of least privilege, ensuring users and services have only the permissions they need to perform their tasks.

Core IAM Concepts & Components

IAM Users: Individual Identities

User Creation Best Practices

• Create individual IAM users (not shared accounts)
• Enforce strong password policies
• Enable MFA for all users, especially those with privileged access
• Use Access Keys only when necessary, rotate regularly
• Assign users to groups for permissions management

User Access Types

User Management Commands

# Create a new user
aws iam create-user --user-name alice

# Add user to group
aws iam add-user-to-group --user-name alice --group-name developers

# Create access key for programmatic access
aws iam create-access-key --user-name alice

# Enable MFA for a user
aws iam enable-mfa-device --user-name alice --serial-number arn:aws:iam::123456789012:mfa/alice --authentication-code1 123456 --authentication-code2 789012

# List user's policies
aws iam list-attached-user-policies --user-name alice

IAM Groups: Organizing Users

Common Group Structures

Group Management Commands

# Create a new group
aws iam create-group --group-name developers

# Attach policy to group
aws iam attach-group-policy --group-name developers --policy-arn arn:aws:iam::aws:policy/AmazonEC2FullAccess

# List groups for user
aws iam list-groups-for-user --user-name alice

# Remove user from group
aws iam remove-user-from-group --user-name alice --group-name developers

# Delete group (must remove all users and detach all policies first)
aws iam delete-group --group-name developers

IAM Roles: Temporary Credentials

Role Types & Use Cases

Role Trust Relationships

Trust policies determine which entities can assume a role:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Common Role Patterns

Role Management Commands

# Create a role
aws iam create-role --role-name s3-read-only --assume-role-policy-document file://trust-policy.json

# Attach policy to role
aws iam attach-role-policy --role-name s3-read-only --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

# List roles
aws iam list-roles

# Get role
aws iam get-role --role-name s3-read-only

# Delete role
aws iam delete-role --role-name s3-read-only

IAM Policies: Permission Definitions

Policy Types

Policy Structure

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:ListBucket"],
      "Resource": [
        "arn:aws:s3:::example-bucket",
        "arn:aws:s3:::example-bucket/*"
      ],
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "203.0.113.0/24"
        }
      }
    }
  ]
}

Policy Elements

Policy Evaluation Logic

1. Explicit deny takes precedence over any allows
2. If no explicit allow, default is deny
3. Multiple policy types are evaluated together:
   • Identity-based policies
   • Resource-based policies
   • SCPs (Organizations)
   • Permission boundaries
   • Session policies

Policy Management Commands

# Create policy
aws iam create-policy --policy-name custom-s3-policy --policy-document file://policy.json

# Get policy
aws iam get-policy --policy-arn arn:aws:iam::123456789012:policy/custom-s3-policy

# List policies
aws iam list-policies --only-attached

# Attach policy to user
aws iam attach-user-policy --user-name alice --policy-arn arn:aws:iam::123456789012:policy/custom-s3-policy

# Detach policy from user
aws iam detach-user-policy --user-name alice --policy-arn arn:aws:iam::123456789012:policy/custom-s3-policy

# Delete policy
aws iam delete-policy --policy-arn arn:aws:iam::123456789012:policy/custom-s3-policy

IAM Security Best Practices

Authentication Controls

MFA Implementation

Least Privilege Implementation

1. Start with minimum permissions, add as needed
2. Analyze access with IAM Access Analyzer
3. Use permission boundaries for delegation
4. Grant temporary permissions for specific tasks
5. Regularly review and remove unused permissions
6. Implement SCPs for organization-wide controls

Common Security Policies

IAM Security Auditing

Key Auditing Tools

Key Auditing Commands

# Generate credential report
aws iam generate-credential-report

# Get credential report
aws iam get-credential-report

# List access keys older than 90 days
aws iam list-access-keys --user-name alice --query 'AccessKeyMetadata[?CreateDate<=`2024-02-08`]'

# Get service last accessed information
aws iam get-service-last-accessed-details --arn arn:aws:iam::123456789012:user/alice

Cross-Account Access Patterns

Cross-Account Role Setup

1. Create role in target account with trusted principal being source account
2. Attach policies to role for necessary permissions
3. Update trust policy to allow specific users/roles in source account
4. Grant source account users permission to assume the role

// Trust policy in target account
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::SOURCE-ACCOUNT-ID:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "aws:PrincipalOrgID": "o-xxxxxxxxxx"
        }
      }
    }
  ]
}

// Policy in source account to allow assuming role
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "arn:aws:iam::TARGET-ACCOUNT-ID:role/CrossAccountRole"
    }
  ]
}

Assuming Cross-Account Roles

# Assume role and get temporary credentials
aws sts assume-role --role-arn arn:aws:iam::TARGET-ACCOUNT-ID:role/CrossAccountRole --role-session-name cross-account-session

# Set temporary credentials in profile
aws configure set aws_access_key_id ASIA1234567890EXAMPLE --profile cross-account
aws configure set aws_secret_access_key wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY --profile cross-account
aws configure set aws_session_token IQoJb3JpZ2luX2VjEP3//////////wEaCXVzLWVhc3QtMSJHMEUCIQDWEwGSr4QpQgRLirXcSAGKsEWAM5buy45awWcr+mYRoAIgNhXvtf6bGBTyLnFPY1tQQXMO4jPO1qKt3HEp7MRxrx8q2wMImf//////////ARAAGgw5NzU0MjYyNzY5NzAiDMoiEXampMnLQpMbmCq3A36%21EXAMPLE --profile cross-account
aws configure set region us-east-1 --profile cross-account

# Use the assumed role
aws s3 ls --profile cross-account

Federation with External Identity Providers

Federation Types

SAML 2.0 Federation Flow

1. User authenticates to corporate IdP
2. IdP sends SAML assertion to user’s browser
3. Browser POSTs assertion to AWS SAML endpoint
4. AWS STS returns temporary credentials
5. User accesses AWS resources with temporary credentials

OIDC Federation Flow

1. App authenticates user with web IdP (Google, Facebook)
2. App receives token from IdP
3. App calls AssumeRoleWithWebIdentity with token
4. AWS STS verifies token and returns temporary credentials
5. App uses credentials to access AWS resources

Troubleshooting IAM Issues

Common Access Issues

Troubleshooting Steps

1. Check explicit denies in all applicable policies
2. Verify resource ARNs are correct and resources exist
3. Review conditions in policies that might be restricting access
4. Check resource-based policies (S3, SQS, etc.)
5. Validate service control policies if using Organizations
6. Verify permission boundaries if applied
7. Check session policies if using temporary credentials
8. Review IAM policy simulator results
9. Analyze CloudTrail logs for detailed error messages

Policy Debugging Tools

Common IAM Tasks: Command Reference

User Management

# Create user
aws iam create-user --user-name bob

# Create login profile (console access)
aws iam create-login-profile --user-name bob --password P@ssw0rd --password-reset-required

# Update user's password
aws iam update-login-profile --user-name bob --password NewP@ssw0rd

# Delete login profile
aws iam delete-login-profile --user-name bob

# Delete user
aws iam delete-user --user-name bob

Group Management

# Create group
aws iam create-group --group-name ProjectA

# Add user to group
aws iam add-user-to-group --group-name ProjectA --user-name bob

# List groups
aws iam list-groups

# List users in group
aws iam get-group --group-name ProjectA

# Remove user from group
aws iam remove-user-from-group --group-name ProjectA --user-name bob

# Delete group
aws iam delete-group --group-name ProjectA

Role Management

# Create role with trust policy
aws iam create-role --role-name lambda-execution --assume-role-policy-document file://trust-policy.json

# List roles
aws iam list-roles

# Get role
aws iam get-role --role-name lambda-execution

# Delete role
aws iam delete-role --role-name lambda-execution

Policy Management

# Create customer managed policy
aws iam create-policy --policy-name custom-policy --policy-document file://policy.json

# List policies
aws iam list-policies --scope Local

# Get policy
aws iam get-policy --policy-arn arn:aws:iam::123456789012:policy/custom-policy

# Get policy document (version)
aws iam get-policy-version --policy-arn arn:aws:iam::123456789012:policy/custom-policy --version-id v1

# Delete policy
aws iam delete-policy --policy-arn arn:aws:iam::123456789012:policy/custom-policy

Access Key Management

# Create access key
aws iam create-access-key --user-name bob

# List access keys
aws iam list-access-keys --user-name bob

# Update access key status
aws iam update-access-key --user-name bob --access-key-id AKIAIOSFODNN7EXAMPLE --status Inactive

# Delete access key
aws iam delete-access-key --user-name bob --access-key-id AKIAIOSFODNN7EXAMPLE

Resources for Further Learning

AWS Official Documentation

• IAM User Guide
• IAM Best Practices
• IAM Policies Reference
• IAM Role Documentation
• IAM Identities

AWS Whitepapers

• AWS Security Best Practices
• AWS Identity and Access Management: Establishing Your Cloud Security Posture

AWS Training

• AWS Identity and Access Management Basics
• AWS Security Fundamentals
• IAM Deep Dive