Identity and Access Management

title: "Identity and Access Management" summary: "A systematic approach to AWS authentication, authorization, federation, policy evaluation, and least-privilege decisions."

Effective permission is a path

Authentication establishes who or what is acting and under which session conditions. Authorization decides whether that principal can perform a specific action on a specific resource in a specific context. Treating IAM as one policy document is the central exam trap.

Evaluate the applicable identity policy, resource policy, role trust, permissions boundary, session policy, service control policy, resource control policy, key policy, VPC endpoint policy, and service-specific behavior. An explicit deny in an applicable layer wins. A boundary or organization policy limits a maximum; it does not grant permission.

Authentication choices

Use workforce federation and IAM Identity Center for managed human access where appropriate. Use roles and temporary credentials for workloads and cross-account access. Consider MFA, session duration, source identity, external IDs, device or network context, credential recovery, and break-glass governance. Long-lived keys embedded in code are a design failure, not an operational shortcut.

Authorization choices

Start with the resource and action. Identify the principal type and account relationship. Map every applicable policy layer, variables, conditions, tags, ownership boundary, and explicit deny. Use access analysis and activity evidence to refine least privilege; do not infer need from broad historic grants.

Self-check

A federated user assumes a cross-account role that accesses an encrypted resource. Explain the trust, identity, resource, organization, boundary, session, endpoint, and KMS decisions that can allow or deny the request.