Authentication verifies the identity of a user, workload, resource, or other entity requesting access. Authorization is separate: it determines what that authenticated identity may do. In AWS, IAM performs both checks for requests to the AWS API. section 5.3.2 section 5.6
AWS uses different identities for different kinds of callers:
- IAM users authenticate people or workloads operating outside AWS, using a username and password for the Management Console or access keys for the CLI. section 5.3.2 section 5.3.4
- IAM roles authenticate AWS resources such as EC2 instances; roles do not use passwords or access keys in the same way IAM users do. section 5.3.2 section 5.3.2
- IAM groups organize users and centralize authorization, but groups cannot authenticate. section 5.3.4
- Identity policies define the actions allowed for users, groups, or roles; identities have no permissions by default. section 5.3.2
Protect credentials with multifactor authentication, especially for administrator access. Prefer named IAM users over continued root-user use, give each person only the permissions needed for the role, and enable MFA for all users. section 5.3 section 5.3.4
Create an IAM administrator
A minimal CLI sequence creates an admin group, attaches AdministratorAccess, creates myuser, adds the user to the group, and creates a console login profile. Replace the password placeholder with a secure password, then enable MFA and stop using the root user. section 5.3.4
Authentication boundaries also apply to managed data services. IAM controls who may administer an ElastiCache cluster, while network security groups control node access and the cache engine controls access inside the cache. Redis versions above 6.0 support token authentication and RBAC; Memcached does not provide user authentication. Enable encryption in transit when transmitting authentication secrets. section 11.3 section 11.3.3
