AWS Identity and Access Management (IAM) Resources

Best practices with IAM


Follow these IAM best practices to help secure your AWS resources using IAM. You can specify who can access which AWS services and resources, and under which conditions.

Best practices with IAM
 

Documentation

IAM user guide

This guide introduces you to IAM by explaining IAM features that help you apply fine-grained permissions in AWS. The guide shows you how to grant access by defining and applying IAM policies to roles and resources. Additionally, this guide explains how IAM works and how you can use IAM to control access for your users and workloads. 

HTML | PDF | Kindle

AWS STS API Reference

This AWS Security Token Service (AWS STS) documentation describes the API operations for you to programmatically assume roles in AWS. The documentation also provides sample requests, responses, and errors for the supported web service protocols.

IAM Access Analyzer user guide

This guide provides conceptual overviews on how to use IAM Access Anaylzer to identify resources shared with an external entitly, validate IAM policies, and generate IAM policies based on access activity.

HTML | PDF

IAM Roles Anywhere user guide

This guide provides conceptual overviews of IAM Roles Anywhere and explains how to use it to obtain temporary security credentials in IAM for workloads such as servers, containers, and applications that run outside of AWS.  

HTML | PDF  


This IAM section of the AWS CLI Command Reference describes the AWS CLI commands you can use to administer IAM. The section also provides syntax, options, and usage examples for each command.

This AWS STS section of the AWS CLI Command Reference documentation describes the AWS CLI commands that you can use to generate temporary security credentials. The section also provides syntax, options, and usage examples for each command.

The IAM API Reference describes in detail all the API operations for IAM. This documentation also provides sample requests, responses, and errors for the supported web services protocols.

Other resources

Sample code and libraries: IAM-related sample code

Developer tools: Command line and GUI-based tools for use with IAM APIs

IAM discussion forum: Discussion forum for IAM-related topics

Workshops

IAM overview lab

This hands on lab is broken into launching EC2 instances with tags, creating IAM identities, testing access for resources, and assigning IAM roles for EC2 instances.

Integrating IAM Access Analyzer in a CI/CD pipeline

In this workshop, learn how to use IAM Access Analyzer policy validation feature, build a CI/CD pipeline using AWS services, and incorporate IAM Access Analyzer policy validation checks into your CI/CD pipeline.

Data protection for hybrid workloads

 In the workshop, you will learn how to utilize IAM Roles Anywhere to secure your on-premise or hybrid workloads by using AWS security services like AWS Key Management Service (AWS KMS), AWS Secrets Manager, and AWS Certificate Manager Private CA (ACM Private CA).
 

Deep dive on IAM Roles Anywhere

This workshop will allow you to dive deep on AWS IAM Roles Anywhere and have a better understanding on how to get access to temporary IAM credentials for workloads outside of AWS.

Videos

AWS re:Inforce 2022 - Security best practices with AWS IAM (IAM201)
AWS re:Inforce 2022 - How to achieve least privilege (IAM303)
Managing hybrid workloads with IAM Roles Anywhere, featuring Hertz (45:03)
Accessing AWS services from workloads running outside of AWS (43:41)
AWS re:Invent 2022 - Harness IAM policies & rein in permissions with IAM Access Analyzer (SEC313)
AWS re:Invent 2022 - Running services without access to data (SEC327)
AWS re:Invent 2022 - A day in the life of a billion requests (SEC404)
AWS re:Invent 2022 - How AWS uses math to prove security (SEC310)
Screenshot from Amazon Verified Permissions video
 
Videos about security-related topics from AWS re:Invent 2022.

Screenshot from Brandon Wu's IAM Access Analyzer video
 
Videos about IAM Access Analyzer, which uses automated reasoning to determine all possible access paths allowed by a resource-based policy.

Screenshot from Brandon Wu's IAM Access Analyzer video
 
AWS re:Inforce 2022 videos that cover identity and access management.

Learn more about IAM

Read the FAQs
Ready to build?
Get started with IAM
Have more questions?
Contact us