AWS Identity and Access Management
Who can do what
Manages identities (users, roles) and policies that decide who can call which API on which resource.
- Cost$ Low
- Difficulty●●●●●
- Costs money when idle?No
- Managed by AWS
- In examsCLF · SAA · DVA · SOA
Think of it asLike a building's keycard system: each card opens only certain doors.
Where does IAM fit?
IAM
A real example, step by step
- A company just opened an AWS account, and everyone is sharing the root user — very dangerous.
- You enable MFA on root, put it away, and create a Developers group with access only to EC2, S3 and Lambda.
- An app on EC2 needs to read S3: you attach an IAM role to the instance instead of writing access keys into a config file.
- AWS hands the role temporary credentials and rotates them regularly, so no permanent key can leak from the code.
- A policy with a Deny on deleting the production bucket blocks that action even when other permissions allow it.
When to use it
✓ Use it when
Always: every call to AWS goes through IAM.
✗ Avoid it when
Sign-in for your app's end users → Cognito.
Common uses
- Roles for EC2/Lambda/ECS to call AWS APIs without access keys
- Least-privilege permissions for people and applications
- Cross-account access with AssumeRole
IAM, IAM Identity Center or Cognito?
| IAM |  IAM Identity Center |  Cognito | |
|---|---|---|---|
| For | Permissions in one AWS account (people, services) | Employees signing in once to many accounts | End users of an application |
| Identities | Users, groups, roles | People from the company directory | User pools, social sign-in |
| Credentials | Passwords, access keys, temporary role credentials | Temporary permissions via permission sets | JWT tokens |
| Cost | Free | Free | Per monthly active user |
What does it cost?
- Pricing model: Free.
- Free tier: Free.
No direct cost, but overly broad permissions can lead to a huge bill if keys leak (used for crypto mining). Use roles instead of long-term access keys.
AWS services (EC2, Lambda) need permissions → an IAM role, never access keys in code. An explicit Deny always beats an Allow. Access from another account → a role that can be assumed cross-account. End-user sign-in for an app → Cognito, not IAM.
Try real exam questions
1A company is planning to run a group of Amazon EC2 instances that connect to an Amazon Aurora database. The company has built an AWS CloudFormation template to deploy the EC2 instances and the Aurora DB cluster. The company wants to allow the instances to authenticate to the database in a secure way. The company does not want to maintain static database credentials. Which solution meets these requirements with the LEAST operational effort?
- ACreate a database user with a user name and password. Add parameters for the database user name and password to the CloudFormation template. Pass the parameters to the EC2 instances when the instances are launched.
- BCreate a database user with a user name and password. Store the user name and password in AWS Systems Manager Parameter Store. Configure the EC2 instances to retrieve the database credentials from Parameter Store.
- CConfigure the DB cluster to use IAM database authentication. Create a database user to use with IAM authentication. Associate a role with the EC2 instances to allow applications on the instances to access the database.
- DConfigure the DB cluster to use IAM database authentication with an IAM user. Create a database user that has a name that matches the IAM user. Associate the IAM user with the EC2 instances to allow applications on the instances to access the database.
Show answer
Correct answer: C
Enable IAM database authentication on Aurora and attach an IAM role to the EC2 instances: the app gets temporary tokens instead of storing a fixed password. Associating an IAM user with EC2 is wrong; EC2 gets permissions through roles.
2An administrator is using Amazon CloudFormation to deploy a three tier web application that consists of a web tier and application tier that will utilize Amazon DynamoDB for storage. When creating the CloudFormation template, which of the following would allow the application instance access to the DynamoDB tables without exposing API credentials?
- ACreate an Identity and Access Management Role that has the required permissions to read and write from the required DynamoDB table and associate the Role to the application instances by referencing an instance profile.
- BUse the Parameter section in the Cloud Formation template to have the user input Access and Secret Keys from an already created IAM user that has the permissions required to read and write from the required DynamoDB table.
- CCreate an Identity and Access Management Role that has the required permissions to read and write from the required DynamoDB table and reference the Role in the instance profile property of the application instance.
- DCreate an identity and Access Management user in the CloudFormation template that has permissions to read and write from the required DynamoDB table, use the GetAtt function to retrieve the Access and secret keys and pass them to the application instance through user-data.
Show answer
Correct answer: C
Create an IAM role with read/write permissions on the DynamoDB table and reference it through the instance profile property of the instance in the template. Never put access keys in parameters or generate them in the template.
Frequently asked questions
What is the difference between an IAM user, group and role?
A user is a long-term identity with a password or access keys. A group collects users so they share permissions. A role has no permanent credentials; it is assumed to get temporary permissions and is used by AWS services (such as EC2 or Lambda), by other accounts or by people signing in through SSO.
Should I use the root account every day?
No. The root user has full access and isn't restricted by policies. Use it only for the few tasks that require it, enable MFA, don't create access keys for it, and use users or SSO with least privilege for daily work.
Does IAM cost anything?
No. IAM is free; you only pay for the resources those identities use.
What do AWS exams ask about IAM?
Least privilege, how policies are evaluated (an explicit Deny always wins), using roles for EC2 or Lambda instead of access keys in code, cross-account access with roles, MFA, and permission boundaries.