All terms
Glossary
IAM
Also: Identity and Access Management
Access management in AWS: who or what may perform which action on which resource.
Permissions attach to identities, roles and policies. For applications, roles are the right way, because they work with short-lived credentials instead of distributing permanent keys.
Evaluation is restrictive: an explicit deny always wins, and without an explicit allow everything is denied.
How you notice it
- Long lived access keys sit in configuration files.
- Roles carry full access because something failed during setup.
- Nobody knows which permissions are actually used.
Frequently asked
How do I tighten permissions after the fact?
From the actions actually used. AWS records every call, which shows what a role really needs. Trimming from that data is an afternoon of work and the single most effective security step in an existing environment.