# IAM

> The rulebook that says who can do what in your AWS account.

- Level: Basic
- Topics: AWS
- URL: https://tidbit.legios.com.ar/iam/
- In Spanish: [IAM](https://tidbit.legios.com.ar/es/iam/)

**IAM** (Identity and Access Management) is the AWS service that controls permissions. Every action in AWS (reading a file in Amazon S3, starting an Amazon EC2 instance, deleting a database) is checked against IAM first: who is asking, and are they allowed? By default the answer is no; you grant permissions explicitly.

It has three main pieces. **Users** are people or programs with their own credentials. **Roles** are sets of permissions that something can take on temporarily: an AWS Lambda function, an EC2 instance, a person from another account. **Policies** are JSON documents that list what is allowed, for example 'allow `s3:GetObject` on the bucket `invoices` and nothing else'. You attach policies to users, groups or roles.

Why it matters: most cloud security incidents are not clever hacks but leaked keys with too many permissions. The habit IAM encourages is **least privilege**: give each person and each program exactly what it needs. A reporting script should be able to read one bucket, not wipe the account.

## An analogy

A building's badge system. Each badge (a user or a role) opens only the doors listed on it (the policies). The cleaning crew's badge opens the offices at night but not the server room, and a lost badge gets cancelled without changing the locks.

## Keep in mind

- Everything is denied until a policy explicitly allows it.
- Prefer roles over long-lived access keys; roles hand out temporary credentials.
- Protect the root user with MFA and almost never use it.
- IAM is free and comes with every AWS account.

## Go deeper

- [What is IAM? (official docs)](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html)
- [AWS IAM](https://aws.amazon.com/iam/)

## Related terms

- [Amazon S3](https://tidbit.legios.com.ar/amazon-s3/): A giant online drawer for files, rented by the gigabyte.
- [Amazon EC2](https://tidbit.legios.com.ar/amazon-ec2/): Virtual computers you rent by the hour, in any size, and switch off when done.
- [Database](https://tidbit.legios.com.ar/database/): An organized store of data that programs can search and update safely.
- [AWS Lambda](https://tidbit.legios.com.ar/aws-lambda/): Run a piece of code only when something happens, with no server to manage.
- [JSON](https://tidbit.legios.com.ar/json/): The plain-text format programs use to hand each other structured data.
- [Cloud computing](https://tidbit.legios.com.ar/cloud-computing/): Renting computers over the internet instead of buying your own.
- [Zero trust](https://tidbit.legios.com.ar/zero-trust/): Security that checks every request, instead of trusting whatever is inside the network.
- [Server](https://tidbit.legios.com.ar/server/): A computer whose job is to answer requests from other computers, all day, every day.