AWS for DevOps — IAM & Security

Chapter 2 — IAM & Security

IAM (Identity and Access Management) is the foundation of everything on AWS. Before you create a single resource, you must understand how AWS controls who can do what. Every API call — whether from the Console, CLI, SDK, or another service — is authenticated and authorised through IAM.

This chapter covers:

Section	Topic
2.1	IAM Users & Groups
2.2	IAM Roles
2.3	IAM Policies
2.4	MFA & Best Practices
2.5	AWS Organizations
2.6	Practice Exercises

Why IAM Is Critical

If IAM is misconfigured:

• Over-permissive policies → developers can accidentally delete production databases
• No MFA → a stolen password gives full account access
• Root account in daily use → one compromised credential, entire account lost

If IAM is done right:

• Each person and service has exactly the permissions they need — nothing more
• Every action is auditable through CloudTrail
• Automated services (Lambda, ECS, CodeBuild) use roles — no hard-coded credentials

  ┌─────────────────────────────────────────────┐
  │                  AWS IAM                     │
  │                                              │
  │  Users ──► Groups ──► Policies               │
  │    │                     │                   │
  │    └──── Roles ◄────────┘                   │
  │            │                                 │
  │   Services (EC2, Lambda, ECS)                │
  │   use Roles for temporary credentials        │
  └─────────────────────────────────────────────┘

By the end of this chapter, you will be able to create users, groups, and roles with least-privilege policies — the most important skill for any DevOps engineer on AWS.

---

Start with → IAM Users & Groups