DEV Community

Cover image for πŸ‘₯ Cloud Identity and Access Management (IAM) πŸ”“
Madhurima Rawat
Madhurima Rawat

Posted on • Originally published at github.com

πŸ‘₯ Cloud Identity and Access Management (IAM) πŸ”“

#cloud #cloudcomputing #aws #iam

🦈 Hello Storage Sharks!!

May all your database data be stored and queried faster than lightning βš‘πŸ“Š

πŸ“š All code, docs, and resources are available in my GitHub repository:

GitHub logo madhurimarawat / Cloud-Computing

This repository focuses on cloud computing and demonstrates how to set up virtual machines, S3, and other services using LocalStack. It provides a comprehensive guide to simulating AWS services locally for development and testing purposes.

Cloud-Computing

This repository focuses on cloud computing and demonstrates how to set up virtual machines, S3, and other services using LocalStack. It provides a comprehensive guide to simulating AWS services locally for development and testing purposes.

Repo Size GitHub Stars GitHub Forks GitHub Issues Closed Issues Open Pull Requests Closed Pull Requests GitHub Discussions GitHub Contributors Top Language License Last Commit Repository Age Workflow Status GitHub Watchers

Tools and Technologies βš™οΈπŸ’»

1. AWS CLI

AWS Command Line Interface (CLI) is a powerful tool that allows users to interact with AWS services directly from the terminal. It simplifies managing cloud resources by providing commands for a wide range of AWS services, enabling tasks such as provisioning, managing, and automating workflows with ease.

2. LocalStack

LocalStack is a fully functional, local testing environment for AWS services. It enables developers to simulate AWS services on their local machines, facilitating the development and testing of cloud-based applications without needing access to an actual AWS account.

3. Docker

Docker is a containerization platform that allows developers to build, share, and run applications in isolated environments called…


View on GitHub


In the last post,
madhurima_rawat

🌩️ Cloud Databases and Data Management πŸ“Š

Madhurima Rawat ・ May 16

#cloud #database #tutorial #docker

we discussed about cloud databases and how data is managed in the cloud.

Today, we’re gonna dive into something even more crucial,
πŸ” Cloud Identity and Access Management (IAM)!

So first I’ll explain what IAM is, and then we’ll move forward to its implementation.
Let’s get those access policies tight and secure like pros! β˜οΈπŸ”πŸ’Ό

Identity and Access Management (IAM)

Identity and Access Management (IAM) is a framework that ensures the right individuals and entities have appropriate access to technology resources. In AWS IAM, users can securely control access to AWS services and resources.

Key Concepts of IAM

1. Identities in IAM

IAM identities define who can access AWS resources and what actions they can perform. These include:

  • Users – Individual accounts with login credentials.
  • Groups – Collections of users sharing permissions.
  • Roles – Assigned temporary permissions for AWS services or external users.

Example: A developer needs access to an S3 bucket. Instead of assigning permissions directly, they are added to the "Developers" IAM group, which has the required permissions.

2. IAM Policies

IAM policies define permissions using JSON-based policy documents specifying what actions are allowed or denied on AWS resources.

Example Policy (Allow full S3 access to a user): 

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:*",
      "Resource": "*"
    }
  ]
}
Enter fullscreen mode Exit fullscreen mode

This grants full S3 permissions to the user.

3. IAM Roles and Temporary Credentials

IAM roles allow users or AWS services to assume temporary permissions to interact with resources securely.

Example Use Cases:

  • EC2 Instance Roles – Instead of embedding credentials in an EC2 instance, an IAM role is assigned with the required permissions.
  • Cross-Account Access – A company allows external contractors to access AWS services via IAM roles without sharing credentials.

aws architecure

4. Multi-Factor Authentication (MFA)

IAM supports MFA, requiring an additional authentication step beyond a username and password.

Example Use Case:

A finance team member accessing sensitive billing data in AWS must verify using Google Authenticator before accessing the console.

5. IAM Best Practices

  • Follow Least Privilege Principle – Users and roles should only have the minimum permissions needed.
  • Enable MFA for All Users – Adds an extra security layer.
  • Use IAM Roles for AWS Services – Avoid storing credentials in applications.
  • Rotate Access Keys Regularly – If access keys are compromised, rotation prevents misuse.

Real-World IAM Use Cases

1. Enterprise-Level Role-Based Access Control (RBAC)

A large organization has departments like HR, Development, and Finance. Each department has specific access needs:

  • HR Team: Can access employee databases but not development resources.
  • Developers: Can deploy applications but cannot modify billing information.
  • Finance: Can view billing dashboards but cannot access production environments.

IAM ensures proper segregation of duties.

2. IAM in Cloud Security & Compliance

A financial institution must comply with PCI-DSS (Payment Card Industry Data Security Standard):

  • IAM enforces policies ensuring only authorized personnel access cardholder data.
  • MFA is required for accessing critical systems.
  • Audit Logs via AWS CloudTrail help track unauthorized access attempts.

Case Study: IAM in a Tech Startup

Company: CloudTech Solutions

Problem: Developers needed access to AWS services, but granting full access posed security risks.

Solution: The company implemented IAM roles and groups:

  • Developers: Given read-only access to production and write access to development environments.
  • Admins: Given full AWS access with MFA enabled.
  • Automated IAM Policy Auditing detected and removed unused permissions.

Outcome:

  • Reduced security risks.
  • Improved compliance with security best practices.
  • Simplified access management.

πŸ–ΌοΈ About the Cover Image:
It starts with a web icon inside a laptop, representing the website or broader cloud ecosystem.
Next, it shows a single user connected to multiple other users through a network and flow icon, illustrating how user roles and policies define connections.
The flow then leads to a lock (πŸ”’) and an identity card icon, symbolizing that only authorized individuals can access specific resources, highlighting the core principles of security and identity management in IAM.

Identity and Access Management (IAM) with Localstack

1. Create a User 

aws iam create-user --user-name test-user
--endpoint-url=%AWS_ENDPOINT_URL%
Enter fullscreen mode Exit fullscreen mode

What it does:

  • Creates a new IAM user named test-user.
  • This user can be assigned roles and policies later.

Expected Output:

{
  "User": {
    "Path": "/",
    "UserName": "test-user",
    "UserId": "AIDAEXAMPLEID",
    "Arn": "arn:aws:iam::123456789012:user/test-user",
    "CreateDate": "2024-03-06T12:00:00Z"
  }
}
Enter fullscreen mode Exit fullscreen mode

2. Create a Role 

aws iam create-role --role-name ec2-role --assume-role-policy-
document file://trust-policy.json --endpoint-url=%AWS_ENDPOINT_URL%
Enter fullscreen mode Exit fullscreen mode

What it does:

  • Creates an IAM role named ec2-role.
  • The role uses a trust policy (stored in trust-policy.json) to define which AWS services or users can assume this role.

Explanation of the Trust Policy Document

This Trust Policy is a JSON document that defines who (which AWS service, user, or account) is allowed to assume an IAM role. This is particularly useful when granting permissions to AWS services like EC2, Lambda, or other entities to access AWS resources.

Breakdown of the JSON Policy 

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
Enter fullscreen mode Exit fullscreen mode

1. "Version": "2012-10-17"

  • Specifies the version of the IAM policy language being used.
  • "2012-10-17" is the latest and recommended version for AWS policies.

2. "Statement": [...]

  • Contains one or more statements defining the permission rules.

Inside the Statement Block:

"Effect": "Allow"
  • Defines whether the policy allows or denies the action.
  • "Allow" means this policy grants permissions.
"Principal": { "Service": "ec2.amazonaws.com" }
  • Specifies who is allowed to assume this role.
  • "Service": "ec2.amazonaws.com" means that the EC2 service (Amazon Elastic Compute Cloud) is allowed to assume this role.
"Action": "sts:AssumeRole"
  • Specifies the action that is permitted.
  • "sts:AssumeRole" allows the EC2 service to assume this role using the AWS Security Token Service (STS).
  • This is required when an EC2 instance needs temporary credentials to interact with other AWS services on behalf of the IAM role.

Use Case Example

  • When you create an IAM Role (e.g., ec2-role) with this trust policy, EC2 instances can assume this role.
  • This is useful when an EC2 instance needs access to S3, DynamoDB, Lambda, etc., without using long-term credentials.
  • AWS securely provides temporary credentials to the EC2 instance through this role.

How This Works in Practice

  1. Create an IAM Role with this trust policy.
  2. Attach permissions to the role (e.g., S3 Read Access).
  3. Assign the IAM Role to an EC2 instance when launching it.
  4. The EC2 instance automatically receives temporary credentials and can access AWS resources as defined in the role's permissions.

Expected Output:

{
  "Role": {
    "Path": "/",
    "RoleName": "ec2-role",
    "RoleId": "AROAXAMPLEID",
    "Arn": "arn:aws:iam::123456789012:role/ec2-role",
    "CreateDate": "2024-03-06T12:05:00Z",
    "AssumeRolePolicyDocument": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "Service": "ec2.amazonaws.com"
          },
          "Action": "sts:AssumeRole"
        }
      ]
    }
  }
}
Enter fullscreen mode Exit fullscreen mode

3. Attach a Policy to the User 

aws iam attach-user-policy --user-name test-user
--policy-arn arn:aws:iam::aws:policy/AdministratorAccess
--endpoint-url=%AWS_ENDPOINT_URL%
Enter fullscreen mode Exit fullscreen mode

What it does:

  • Attaches the AdministratorAccess policy to test-user, giving full access to AWS resources.

Expected Output:

No direct output. The policy is attached successfully.

To verify, use the list-attached-user-policies command.

4. List Users 

aws iam list-users --endpoint-url=%AWS_ENDPOINT_URL%
Enter fullscreen mode Exit fullscreen mode

What it does:

  • Lists all IAM users in the account.

Expected Output:

{
  "Users": [
    {
      "Path": "/",
      "UserName": "test-user",
      "UserId": "AIDAEXAMPLEID",
      "Arn": "arn:aws:iam::123456789012:user/test-user",
      "CreateDate": "2024-03-06T12:00:00Z"
    }
  ]
}
Enter fullscreen mode Exit fullscreen mode

5. List Roles 

aws iam list-roles --endpoint-url=%AWS_ENDPOINT_URL%
Enter fullscreen mode Exit fullscreen mode

What it does:

  • Lists all IAM roles in the account.

Expected Output:

{
  "Roles": [
    {
      "Path": "/",
      "RoleName": "ec2-role",
      "RoleId": "AROAXAMPLEID",
      "Arn": "arn:aws:iam::123456789012:role/ec2-role",
      "CreateDate": "2024-03-06T12:05:00Z"
    }
  ]
}
Enter fullscreen mode Exit fullscreen mode

6. List Attached Policies for a User 

aws iam list-attached-user-policies --user-name test-user
--endpoint-url=%AWS_ENDPOINT_URL%
Enter fullscreen mode Exit fullscreen mode

What it does:

  • Displays the policies attached to test-user.

Expected Output:

{
  "AttachedPolicies": [
    {
      "PolicyName": "AdministratorAccess",
      "PolicyArn": "arn:aws:iam::aws:policy/AdministratorAccess"
    }
  ]
}
Enter fullscreen mode Exit fullscreen mode

These commands help manage IAM users, roles, and permissions efficiently. Using LocalStack, this can be tested in a local environment before deploying in AWS.

πŸ“„ Want to see how it all worked step by step? Check it out here:
πŸ”— Experiment 8 Output (PDF)

🧠 Curious about how each command runs and responds? See the detailed input-output flow here:
πŸ–₯️ IAM Setup Input-Output Flow (PDF)

πŸŽ‰ And that’s a wrap on Identity and Access Management (IAM)!

πŸ“š Found great IAM tutorials, cheat sheets, or guides? Drop them in the comments. I’d love to check them out and share them with others!

πŸ”₯ Stay tuned for the next article!
Next up, we’ll explore Cloud Monitoring and Logging β€” where you'll learn how to track activity and monitor resources effectively in a cloud environment. πŸ“ˆπŸ”

Top comments (4)

Collapse
 
dotallio profile image
Dotallio •

The hands-on LocalStack examples with IAM are super helpful, really makes local cloud development so much smoother for me!
If you find any more hidden gems or tools for simulating cloud security locally, I'd love to hear about them.

Collapse
 
madhurima_rawat profile image
Madhurima Rawat •

Thanks a lot, that means a lot to hear. I'm really happy the IAM examples helped you out.

I'll definitely keep sharing anything I find that makes simulating cloud security locally even easier.

Collapse
 
nevodavid profile image
Nevo David •

Pretty cool seeing such a clear step-by-step on IAM - setting it all up used to stress me out but this makes it feel way less scary.

Collapse
 
madhurima_rawat profile image
Madhurima Rawat •

I'm really glad you found it helpful.
I remember when I was starting out, IAM felt pretty overwhelming. But as you keep working with it, it starts to make more sense. It's great to hear that the article made it feel a bit less scary for you.