Module Overview

• AWS Identity and Access Management (IAM)
• Authentication vs. authorization
• Resources, accounts, and AWS Organizations
• IAM best practices

Security Credential Types

Best practice: never use the root user for day-to-day tasks.

IAM Users, Groups, and Roles

• IAM user: identity with username/password, access keys, permissions
• Group: collection of IAM users — not itself a principal
• Role: temporary credentials assumable by users, services, or federated identities
• Federated users: external users using short-term security credentials

Principle of Least Privilege

• Grant only the permissions required to perform a task
• Start with AWS managed policies, then refine toward least privilege
• Default: new IAM users have no permissions

Policy Elements

Policy Types

• Identity-based policies (attached to users/groups/roles)
• Resource-based policies (attached to resources)
• AWS Organizations Service Control Policies (SCPs)
• Resource Control Policies (RCPs)

Best Practices for IAM

• Start with AWS managed policies
• Use multi-factor authentication (MFA)
• Rotate credentials regularly
• Review and audit access with IAM Access Analyzer + credential reports
• Remove unnecessary credentials
• Automate policy simulations before granting access

AWS Organizations

• Centralized account management and auditing
• Group-based account management (Organizational Units)
• Policy-based access to AWS services via SCPs
• Automated account creation and management

Troubleshooting Scenario

Module Summary

Next: Module 3 — System Discovery