AWS Identity and Access Management (IAM) enables you to securely control access to AWS services and resources for your users. Using IAM, you can create and manage AWS users and groups, and use permissions to allow and deny their access to AWS resources.
IAM is a feature of your AWS account offered at no additional charge. You will be charged only for use of other AWS services by your users.
To get started using IAM, or if you have already registered with AWS, go to the AWS Management Console and get started with these IAM Best Practices.
How-To:
Announcement:
Join Us for AWS IAM Day on Monday, October 16, in New York City
Announcement:
Join AWS Security on October 4 for a Night of Trivia at Grace Hopper Celebration 2017
Announcement:
The Top 20 AWS IAM Documentation Pages so Far in 2017
Announcement:
AWS EU (London) Region Selected to Provide Services to Support UK Law Enforcement Customers
How-To:
How to Enable LDAPS for Your AWS Microsoft AD Directory
How-To:
How-To:
Reset Your AWS Root Account's Lost MFA Device Faster by Using the AWS Management Console
How-To:
Greater Transparency into Actions AWS Services Perform on Your Behalf by Using AWS CloudTrail
How-To:
How to Query Personally Identifiable Information with Amazon Macie
How-To:
AWS IAM Policy Summaries Now Help You Identify Errors and Correct Permissions in Your IAM Policies
Announcement:
AWS Earns Department of Defense Impact Level 5 Provisional Authorization
How-To:
Now Create and Manage AWS IAM Roles More Easily with the Updated IAM Console
How-To:
How to Configure
Announcement:
Now Available: Improvements to How You Sign In to Your AWS Account
Announcement:
AWS Earns Department of Defense Impact Level 5 Provisional Authorization
How-To:
Now Create and Manage AWS IAM Roles More Easily with the Updated IAM Console
How-To:
How to Configure
Announcement:
Now Available: Improvements to How You Sign In to Your AWS Account
Use fine-grained access control, integrate with your corporate directory, and require MFA for highly privileged users
IAM enables your users to control access to AWS service APIs and to specific resources. IAM also enables you to add specific conditions such as time of day to control how a user can use AWS, their originating IP address, whether they are using SSL, or whether they have authenticated with a multi-factor authentication device.
You can enable your mobile and browser-based applications to securely access AWS resources by requesting temporary security credentials that grant access only to specific AWS resources for a configurable period of time.
Protect your AWS environment by using AWS MFA, a security feature available at no extra cost that augments user name and password credentials. MFA requires users to prove physical possession of a hardware MFA token or MFA-enabled mobile device by providing a valid MFA code.
IAM can be used to grant your employees and applications federated access to the AWS Management Console and AWS service APIs, using your existing identity systems such as Microsoft Active Directory. You can use any identity management solution that supports SAML 2.0, or feel free to use one of our federation samples (AWS Console SSO or API federation).
IAM assists in creating roles and permissions
AWS IAM allows you to:
- Manage IAM users and their access – You can create users in IAM, assign them individual security credentials (in other words, access keys, passwords, and multi-factor authentication devices), or request temporary security credentials to provide users access to AWS services and resources. You can manage permissions in order to control which operations a user can perform.
- Manage IAM roles and their permissions – You can create roles in IAM and manage permissions to control which operations can be performed by the entity, or AWS service, that assumes the role. You can also define which entity is allowed to assume the role. In addition, you can use service-linked roles to delegate permissions to AWS services that create and manage AWS resources on your behalf.
- Manage federated users and their permissions – You can enable identity federation to allow existing identities (users, groups, and roles) in your enterprise to access the AWS Management Console, call AWS APIs, and access resources, without the need to create an IAM user for each identity. Use any identity management solution that supports SAML 2.0, or use one of our federation samples (AWS Console SSO or API federation).
Manage access control without losing flexibility or resiliency
AWS has a list of best practices to help IT professionals and developers. To get a full explanation of IAM best practices, watch the recorded session from re:Invent 2015 (in the video player to the right of this paragraph).
Users – Create individual users.
Groups – Manage permissions with groups.
Permissions – Grant least privilege.
Auditing – Turn on AWS CloudTrail.
Password – Configure a strong password policy.
MFA – Enable MFA for privileged users.
Roles – Use IAM roles for Amazon EC2 instances.
Sharing – Use IAM roles to share access.
Rotate – Rotate security credentials regularly.
Conditions – Restrict privileged access further with conditions.
Root – Reduce or remove use of root.