thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Cloud Computing · Foundational

AWS Identity and Access Management (IAM)

Global AWS service for controlling authentication and authorization to AWS resources through users, groups, roles and policies.

Definition

AWS IAM lets you define who (principals) can perform which actions on which resources under which conditions, using JSON policies. It is a global service at no additional charge. Best practices include locking down the root user, using federation and roles with temporary credentials, enforcing MFA and granting least privilege.

Example

An IAM role grants an EC2 instance read-only access to a single S3 bucket without storing keys on the server.

Exam tip

IAM is global, not regional; and access denied by default (implicit deny) unless a policy explicitly allows.

Related terms