> For the complete documentation index, see [llms.txt](https://awsinpractice.itassist.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://awsinpractice.itassist.com/study-group/aws-certified-solutions-architect-associate/domain-1-design-secure-architectures/copy-of-task-statement-1.1-design-secure-access-to-aws-resources/copy-of-aws-identity-and-access-management-iam-fundamentals.md).

# Copy of AWS Identity & Access Management (IAM) Fundamentals

## **What is AWS IAM?**

AWS Identity & Access Management (IAM) is the foundation of **secure access control** in AWS. It manages **who** can access AWS resources, **what** they can do, and **how** access is granted.

### **Key IAM Features**

* User authentication & authorization
* Granular access controls with policies
* Role-based access management (RBAC)
* Temporary security credentials for workloads
* Integration with Identity Providers (Okta, Azure AD, etc.)

### **How SecureCart Uses IAM**

SecureCart uses IAM to **control access to AWS services and resources** while following **security best practices** to protect customer data, prevent unauthorized changes, and enable seamless operations.

### Examples

* Developers need to manage deployments but should NOT have full admin access.
* SecureCart’s EC2 instances need to retrieve product images from S3 **without storing credentials**.
* A Lambda Function Needs to Process Payments Using AWS Secrets Manager
* SecureCart’s CI/CD Pipeline in the `DevOps` Account Needs to Deploy to `Production`
* SecureCart’s security engineers **should be able to audit AWS resources but NOT make changes**.

| **Scenario**                                      | **IAM Solution**                                      |
| ------------------------------------------------- | ----------------------------------------------------- |
| **Developer Access to AWS Accounts**              | IAM Identity Center (SSO) with Permission Sets        |
| **EC2 Access to S3 for Product Images**           | IAM Role assigned to EC2 instance                     |
| **Lambda Access to Secrets Manager for Payments** | IAM Role with Secrets Manager read access             |
| **CI/CD Deployment Across Accounts**              | Cross-account IAM Role assumption                     |
| **Security Team Read-Only Audits**                | IAM Identity Center Group with `SecurityAudit` policy |

***

## **IAM Users**

* IAM Users represent individuals who need access to AWS.
* Each IAM User has unique credentials (password, access keys, MFA) and can have assigned permissions.

### **How SecureCart Uses IAM Users**

* Only used for break-glass access (not for daily work).
* SecureCart relies on IAM Identity Center (SSO) instead of IAM Users for authentication.
* MFA is required for any IAM User with AWS Management Console access.

***

## **IAM Groups**

* IAM Groups **combine multiple IAM Users** and assign permissions to them collectively.
* Instead of assigning policies **one by one**, a **group policy applies to all users inside the group.**

#### **How SecureCart Uses IAM Groups**

* SecureCart avoids IAM Groups in favor of IAM Identity Center (SSO).
* If IAM Groups were needed, SecureCart would create
  * `Billing-ReadOnly` (Finance Team)
  * `Security-Audit` (Security Team)
  * `DevOps-Admin` (Operations Team)

***

## **IAM Policies**

* IAM Policies define permissions for users, groups, or roles.
* They specify who can do what on which resources.

### **Types of IAM Policies**

* AWS-Managed Policies → Predefined by AWS (e.g., `AdministratorAccess`, `ReadOnlyAccess`).
* Customer-Managed Policies → Custom policies SecureCart creates for fine-grained control.
* Inline Policies → Directly attached to users, groups, or roles (not reusable).

### **How SecureCart Uses IAM Policies**

* Least privilege (Only allow necessary actions).
* Deny dangerous actions like deleting databases.
* Use AWS-Managed Policies for standard use cases.

***

## **IAM Roles**

* IAM Roles provide temporary permissions to users, AWS services, or applications.
* Unlike IAM Users, IAM Roles do not have permanent credentials.

### **IAM Role Use Cases**

* Applications running on EC2, Lambda, or ECS that need access to AWS services.
* Cross-account access between different AWS accounts.
* Temporary security credentials for users via AWS STS.

### **How SecureCart Uses IAM Roles**

* SecureCart EC2 instances assume IAM Roles to access S3 securely.
* Developers assume IAM Roles instead of using IAM Users.
* Cross-account roles allow CI/CD to deploy across multiple AWS accounts

***

### **IAM Identity Center (SSO)**

* IAM Identity Center (formerly AWS SSO) provides centralized authentication for multiple AWS accounts.
* It eliminates the need for IAM Users by integrating with identity providers like Okta, Azure AD, or Google Workspace.

### **How SecureCart Uses IAM Identity Center**

* Developers log in once and access multiple AWS accounts.
* IAM Identity Center groups replace IAM Groups.
* Enforces MFA and session timeouts for security.

###  **Example of IAM Identity Center Group Setup**

| **IAM Identity Center Group** | **AWS Permissions Assigned** |
| ----------------------------- | ---------------------------- |
| `SecureCart-Developers`       | AWSCodeDeployFullAccess      |
| `SecureCart-Security`         | SecurityAudit                |
| `SecureCart-Finance`          | Billing                      |

***

## **AWS Security Best Practices for IAM**

### **SecureCart's IAM Security Checklist**

* Use IAM Identity Center (SSO) instead of IAM Users
* Require MFA for all human access
* Use IAM Roles instead of long-term IAM credentials
* Follow the principle of least privilege in IAM Policies
* Enable IAM Access Analyzer to detect misconfigurations
* Use AWS CloudTrail to log IAM activity

####

####

#### **Scenario:**

**SecureCart’s security team is tasked with setting up secure IAM access for engineers, ensuring that only authorized users and services have access to AWS resources.**

#### **Key Learning Objectives**

* **Understand IAM Users, Groups, and Roles**
* **Enforce MFA on IAM users and the root user**
* **Learn about the AWS Shared Responsibility Model**
* **Apply AWS security best practices for access control**

## **Introduction**

[**SecureCart Organizational Structure & AWS Access Roles**](https://awsinpractice.itassist.com/study-group/aws-certified-solutions-architect-associate/securecart#securecart-organizational-structure-and-aws-access-roles)

### **AWS Access Requirements by Role**

|                         |                                                |                                                |
| ----------------------- | ---------------------------------------------- | ---------------------------------------------- |
| **Role**                | **Access Level**                               | **AWS Services Required**                      |
| **CTO**                 | Read-only                                      | AWS Billing, Cost Explorer, Budgets            |
| **Finance Team**        | Billing & Cost Access                          | AWS Billing, AWS Cost Explorer                 |
| **DevOps Team**         | Full Admin (Non-Prod), Restricted Admin (Prod) | IAM, EC2, VPC, RDS, CloudFormation, Route 53   |
| **Software Developers** | Limited (Deploy Only)                          | ECS, Lambda, API Gateway, DynamoDB, CloudWatch |
| **Data Engineers**      | Full Access to Data Services                   | Redshift, S3, Glue, DynamoDB, Athena           |
| **Security Team**       | Full Security Admin                            | IAM, GuardDuty, Security Hub, CloudTrail       |
| **Customer Support**    | Read-Only                                      | DynamoDB (customer and order data)             |
| **Product Management**  | Read-Only                                      | CloudWatch, DynamoDB                           |

##

## **SecureCart - Single AWS Account Setup (IAM-Based)**

**This setup is used when SecureCart operates within a single AWS account, managing access through IAM roles and IAM policies.**

### **Step 1: Create IAM Roles for Each Business Unit**

**Why? IAM Roles provide temporary credentials instead of static IAM users, improving security.**

#### **Create IAM Roles & Attach Policies**

**Use the AWS Console or CLI to create IAM Roles for each team.**

**Example CLI Command to Create an IAM Role for Developers**

```sh
shCopyEditaws iam create-role --role-name SecureCartDeveloperRole \
  --assume-role-policy-document file://developer-trust-policy.json
```

**Trust Policy (`developer-trust-policy.json`)**

```json
jsonCopyEdit{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111122223333:user/developer"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
```

**📌 Attach a Policy (Limited Access to Deployment Services)**

```sh
shCopyEditaws iam attach-role-policy --role-name SecureCartDeveloperRole \
  --policy-arn arn:aws:iam::aws:policy/AWSCodeDeployFullAccess
```

***

### **🔹 Step 2: Assign IAM Roles to Users**

**1️⃣ Go to AWS IAM Console**\
**2️⃣ Select "Users" → Choose User → Assign Role**\
**3️⃣ Choose the appropriate role (e.g., SecureCartDeveloperRole)**\
**4️⃣ Save changes**

**🔹 Now, Developers must "AssumeRole" to gain AWS permissions.**

**📌 Example: Assume Role via AWS CLI**

```sh
shCopyEditaws sts assume-role --role-arn arn:aws:iam::111122223333:role/SecureCartDeveloperRole \
  --role-session-name DeveloperSession
```

***

### **🔹 Step 3: Enforce MFA for AWS Console Access**

**📌 Why? Improves security by preventing unauthorized access.**

**1️⃣ Go to AWS IAM Console → Users → Security Credentials**\
**2️⃣ Enable MFA for each user**\
**3️⃣ Require MFA in IAM Policies**

**📌 Example IAM Policy to Enforce MFA**

```json
jsonCopyEdit{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*",
      "Condition": {
        "BoolIfExists": { "aws:MultiFactorAuthPresent": "false" }
      }
    }
  ]
}
```

## **SecureCart Multi-Account IAM Identity Center Setup**

### **🔹 Overview**

**SecureCart needs a centralized access management solution to allow different teams to securely access multiple AWS accounts with appropriate permissions.**

#### **✅ Key IAM Identity Center Components**

1. **Users & Groups → Define who has access**
2. **Permission Sets → Define what permissions are granted**
3. **Account Assignments → Assign permission sets to groups/users at the AWS account level**

***

### **🔹 Step 1: Enable AWS IAM Identity Center (SSO)**

**📌 Why?**\
**Provides SSO-based access across multiple AWS accounts, eliminating the need for IAM users.**

#### **Implementation Steps:**

**1️⃣ Go to AWS Organizations Console → Enable IAM Identity Center**\
**2️⃣ Choose an Identity Source:**

* **Built-in AWS Identity Center Directory (Default)**
* **External Identity Provider (Azure AD, Okta, Google Workspace)**\
  **3️⃣ Configure IAM Identity Center login portal**
* **AWS generates a unique SSO login URL for SecureCart employees**

**📌 Example CLI Command to Enable IAM Identity Center**

```sh
shCopyEditaws sso-admin create-instance --region us-east-1
```

***

### **🔹 Step 2: Create IAM Identity Center Groups**

**📌 Why?**\
**IAM Identity Center Groups simplify permission management by allowing multiple users to inherit permissions instead of assigning them individually.**

#### **✅ Create Groups for Each SecureCart Business Unit**

**1️⃣ Go to IAM Identity Center Console → Groups → Create Group**\
**2️⃣ Create the following Groups:**

* **`SecureCart-DevOps`**
* **`SecureCart-Developers`**
* **`SecureCart-Security`**
* **`SecureCart-Finance`**
* **`SecureCart-Support` 3️⃣ Add Users to the Groups**

**📌 Example CLI Command to Create a Group**

```sh
shCopyEditaws sso-admin create-group --name SecureCart-Developers --instance-arn arn:aws:sso:::instance/ssoins-EXAMPLE
```

***

### **🔹 Step 3: Create Permission Sets**

**📌 Why?**\
**Permission Sets define the AWS permissions for each team. These are assigned at the AWS account level.**

#### **✅ Define Permission Sets**

**1️⃣ Go to IAM Identity Center Console → Permission Sets → Create New Set**\
**2️⃣ Choose AWS-Managed Policies or Custom Policies**\
**3️⃣ Assign Session Duration (default: 1 hour, max: 12 hours)**\
**4️⃣ Repeat this for each business unit**

**📌 Example Permission Sets for SecureCart Teams**

| **Group**               | **Permission Set**                     | **Attached IAM Policies**                             |
| ----------------------- | -------------------------------------- | ----------------------------------------------------- |
| `SecureCart-DevOps`     | **SecureCart-DevOps-PermissionSet**    | `AdministratorAccess`                                 |
| `SecureCart-Developers` | **SecureCart-Developer-PermissionSet** | `AWSCodeDeployFullAccess`, `CloudWatchReadOnlyAccess` |
| `SecureCart-Security`   | **SecureCart-Security-PermissionSet**  | `SecurityAudit`, `IAMReadOnlyAccess`                  |
| `SecureCart-Finance`    | **SecureCart-Finance-PermissionSet**   | `Billing`                                             |
| `SecureCart-Support`    | **SecureCart-Support-PermissionSet**   | `ReadOnlyAccess`                                      |

**📌 Example CLI Command to Create a Permission Set**

```sh
shCopyEditaws sso-admin create-permission-set \
  --instance-arn arn:aws:sso:::instance/ssoins-EXAMPLE \
  --name SecureCart-Developers-PermissionSet \
  --description "Developer access to AWS services" \
  --session-duration PT8H
```

***

### **🔹 Step 4: Assign Groups to AWS Accounts**

**📌 Why?**\
**Permission Sets are assigned at the AWS account level, ensuring users can only access the accounts they need.**

#### **✅ Assign Groups to AWS Accounts**

**1️⃣ Go to IAM Identity Center Console → AWS Accounts**\
**2️⃣ Select the AWS account (e.g., `SecureCart-Production`, `SecureCart-Dev`)**\
**3️⃣ Click Assign Users & Groups**\
**4️⃣ Select the SecureCart Group (e.g., `SecureCart-Developers`)**\
**5️⃣ Assign the corresponding Permission Set**\
**6️⃣ Click Save**

**📌 Example CLI Command to Assign a Group to an AWS Account**

```sh
shCopyEditaws sso-admin create-account-assignment \
  --instance-arn arn:aws:sso:::instance/ssoins-EXAMPLE \
  --target-id 123456789012 \
  --target-type AWS_ACCOUNT \
  --principal-id SecureCart-Developers \
  --principal-type GROUP \
  --permission-set-arn arn:aws:sso:::permissionSet/ssoins-EXAMPLE/ps-EXAMPLE
```

***

### **🔹 Step 5: User Login & Access via AWS SSO**

**📌 Why?**\
**Instead of manually switching IAM roles, users log in via AWS SSO and are automatically assigned role-based access.**

#### **✅ How Users Access AWS**

**1️⃣ Users go to the AWS IAM Identity Center Portal (SSO URL)**\
**2️⃣ Login using corporate credentials**\
**3️⃣ Select the AWS Account & Role they have access to**\
**4️⃣ They are granted console or CLI access automatically**

**📌 Example: AWS SSO Login for Developers**

```sh
shCopyEditaws sso login --profile SecureCart-Developers
```

***

## **Summary: Single vs. Multi-Account Implementation**

| **Feature**             | **Single Account (IAM-Based)**   | **Multi-Account (IAM Identity Center-Based)** |
| ----------------------- | -------------------------------- | --------------------------------------------- |
| **User Authentication** | IAM Users                        | AWS IAM Identity Center (SSO)                 |
| **Access Control**      | IAM Roles                        | IAM Identity Center Groups & Permission Sets  |
| **Role Switching?**     | Users must assume roles manually | Seamless via AWS SSO                          |
| **Permissions Model**   | IAM Policies per Role            | Permission Sets per Account                   |
| **Best for**            | Standalone AWS Accounts          | Multi-Account AWS Organizations               |

***

##

**For multi-account AWS Organizations setups, SecureCart centralizes access control using AWS IAM Identity Center (SSO).**

### **Step 1: Enable AWS IAM Identity Center (SSO)**

**Why? Provides centralized identity management across multiple AWS accounts.**

**Go to AWS Organizations Console → Enable IAM Identity Center**\
**Choose an Identity Source:**

* **Built-in AWS Identity Center Directory**
* **External IdP (Okta, Azure AD, Google Workspace)**

**📌 Example CLI Command to Enable IAM Identity Center**

```sh
shCopyEditaws sso-admin create-instance --region us-east-1
```

***

### **Step 2: Create IAM Identity Center Groups**

**📌 Why? Groups simplify permission assignments for multiple users.**

#### **✅ Create Groups for Each Business Unit**

**1️⃣ Go to IAM Identity Center Console → Groups → Create Group**\
**2️⃣ Example Groups:**

* **`SecureCart-DevOps`**
* **`SecureCart-Developers`**
* **`SecureCart-Security`**
* **`SecureCart-Finance`**
* **`SecureCart-Support` 3️⃣ Add Users to Respective Groups**

***

### **Step 3: Assign Permission Sets to IAM Identity Center Groups**

**📌 Why? Permission Sets are predefined IAM roles assigned to Identity Center users.**

#### **Create Permission Sets**

**1️⃣ Go to AWS IAM Identity Center Console → Permission Sets → Create New Set**\
**2️⃣ Select AWS-Managed Policies or Custom Policies**

* **`SecureCart-DevOps` → AdministratorAccess**
* **`SecureCart-Developers` → AWSCodeDeployFullAccess**
* **`SecureCart-Security` → SecurityAudit**
* **`SecureCart-Finance` → Billing**
* **`SecureCart-Support` → ReadOnlyAccess 3️⃣ Assign Permission Sets to Groups**

**Example CLI Command to Assign a Permission Set**

```sh
shCopyEditaws sso-admin create-permission-set \
  --instance-arn arn:aws:sso:::instance/ssoins-EXAMPLE \
  --name SecureCart-Developers \
  --description "Developer access to AWS services" \
  --session-duration PT8H
```

***

### **Step 4: Assign Groups to AWS Accounts**

**📌 Why? This allows IAM Identity Center users to assume roles only in permitted accounts.**

**1️⃣ Go to IAM Identity Center Console → AWS Accounts → Assign Users & Groups**\
**2️⃣ Choose the SecureCart Group (e.g., `SecureCart-Developers`)**\
**3️⃣ Assign the corresponding permission set**\
**4️⃣ Click Save**

**🔹 Now, users log in via AWS IAM Identity Center (SSO) and get role-based access.**

**📌 Example: IAM Identity Center Console Access**

* **Users log in via AWS SSO URL.**
* **Choose the assigned AWS account & IAM Role.**
* **No need for manual IAM Role switching.**

***

### **🎯 Summary: Single vs. Multi-Account Setup**

| **Feature**             | **Single Account (IAM-Based)**   | **Multi-Account (Identity Center-Based)**    |
| ----------------------- | -------------------------------- | -------------------------------------------- |
| **User Authentication** | IAM Users                        | AWS IAM Identity Center (SSO)                |
| **Access Control**      | IAM Roles                        | IAM Identity Center Groups & Permission Sets |
| **Best for**            | Standalone AWS Accounts          | Multi-Account AWS Organizations              |
| **IAM Groups Needed?**  | Maybe (for legacy users)         | ❌ No (Use Identity Center Groups)            |
| **Role Switching?**     | Users must assume roles manually | Seamless via AWS SSO                         |

###

###

### **IAM Policies & Permissions Model**

**SecureCart follows the principle of least privilege, meaning each team gets only the permissions necessary to perform their job.**

#### **✅ Implementation Steps:**

**1️⃣ Enable AWS IAM Identity Center (SSO)**

* **Integrate Azure AD, Okta, or Google Workspace for authentication.**
* **Define SSO permission sets for different roles.**

**2️⃣ Create IAM Roles for Each Team**

* **DevOpsRole (Admin in non-prod, restricted in prod).**
* **DeveloperRole (Deploy access, no security permissions).**
* **SecurityRole (IAM & Security services access only).**
* **SupportRole (Read-only to customer order database).**
* **FinanceRole (Billing access only).**

**3️⃣ Apply IAM Policies with Least Privilege**

* **Restrict DevOps team to modify infrastructure but not IAM.**
* **Ensure Developers can deploy but not access customer data.**
* **Allow Finance to view AWS bills without modifying resources.**
* **Block Support from accessing anything except order-related DynamoDB tables.**

**4️⃣ Use AWS Organizations & SCPs for Governance**

* **Deny actions like `iam:CreateUser`, `s3:PutBucketPublicAccessBlock` across all accounts.**
* **Enforce security best practices at the organization level.**

**5️⃣ Enable AWS IAM Access Analyzer**

* **Continuously scan for overly permissive IAM policies.**
* **Detect unintended public access to AWS resources.**

### **AWS Identity & Access Best Practices for SecureCart**

**✅ Use IAM Roles for Applications & Services – No hardcoded credentials.**\
**✅ Enable Multi-Factor Authentication (MFA) – Required for all human users.**\
**✅ Monitor IAM Usage with AWS CloudTrail – Track API calls for security audits.**\
**✅ Implement Temporary Credentials with AWS STS – Use AssumeRole instead of long-term IAM users.**\
**✅ Use Resource-Based Policies for Specific Permissions – Example: Secure S3 access with bucket policies.**

#### **Hands-on Labs:**

**1️⃣ Enable MFA for Root & IAM Users**\
**2️⃣ Create IAM Groups & Assign Least Privilege Access**\
**3️⃣ Implement IAM Policies to Restrict Overly Permissive Access**

**🔹 Outcome: SecureCart implements strong IAM security controls, ensuring that only authorized users have access.**