AWS Identity and Access Management (IAM) controls authentication and authorization for the AWS API: it verifies who makes a request and whether that identity may perform the requested action. section 5.3.2
IAM organizes AWS access through four core components:
- IAM users authenticate people or workloads running outside AWS. section 5.3.2
- IAM groups collect users with shared permissions. section 5.3.2
- IAM roles authenticate AWS resources such as EC2 instances and can be associated with ECS containers or Lambda functions. section 5.3.2
- Identity policies define permitted actions for users, groups, or roles; identities have no permissions by default. section 5.3.2
Use the IAM concepts figure to compare users, groups, roles, and identity policies in one view. section 5.3.2
Grant only the permissions an identity needs. IAM governs AWS service configuration and management, but it does not replace service-level or network controls: RDS database access belongs to the database engine, while cache-node access uses security groups and optional Redis authentication. section 10.4.1 section 11.3.1
Restricting RDS administration
An identity policy can allow RDS management actions while explicitly denying rds:Delete* and rds:Remove*. The explicit Deny overrides an Allow, reducing the risk of destructive human errors. section 10.4.1
