Authorization determines whether an authenticated identity may perform a requested action. For AWS API requests, Identity and Access Management (IAM) verifies who is making the request, then checks whether that identity is allowed to act. Authentication answers “who?”; authorization answers “can they do this?” section 5.3.2
IAM assigns permissions through identities and policies:
- Users represent people or workloads outside AWS. Groups collect users who need the same permissions; groups do not authenticate on their own. section 5.3.2 section 5.3.4
- Roles authenticate AWS resources such as EC2 instances. Identity policies state which actions a user, group, or role may perform. Users and roles cannot perform actions by default. section 5.3.2
- Give each identity only the permissions it needs. Use individual IAM users rather than the AWS account root user for routine access, and enable multi-factor authentication for users. section 5.3.4
Permission to administer a service is not necessarily permission to reach or use its data. For an RDS database, IAM controls configuration actions such as creating, updating, and deleting an instance. Security groups control network access, while the database engine manages access inside the database. Configuring these rules is your responsibility under AWS’s shared-responsibility model. section 10.4 section 10.4.1
Prevent destructive RDS management actions
An IAM identity policy can allow `rds:*` while explicitly denying `rds:Delete*` and `rds:Remove*`. Attach it to the users, groups, or roles whose RDS management actions it should govern. The Deny overrides the Allow, reducing the risk of accidental deletion. Because `rds:*` otherwise grants broad management access, assign this policy only where that access is needed; it does not set permissions inside the database. section 10.4.1
Listing 10.5 IAM policy denying destructive actions
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow", #1
"Action": "rds:*", #2
"Resource": "*" #3
}, {
"Effect": "Deny", #4
"Action": ["rds:Delete*", "rds:Remove*"], #5
"Resource": "*" #6
}]
}
Inspect the IAM policy statements to see how an explicit denial limits an otherwise broad RDS management allowance. section 10.4.1
The same boundary matters for a cache. IAM controls who may administer an ElastiCache cluster, not who may access its nodes or data. Security groups restrict network traffic; Redis versions above 6.0 support authentication and role-based authorization within the cache, while Memcached does not support authentication. section 11.3 section 11.3.1
