Best practices with IAM
Follow these IAM best practices to help secure your AWS resources using IAM. You can specify who can access which AWS services and resources, and under which conditions.
This guide introduces you to IAM by explaining IAM features that help you apply fine-grained permissions in AWS. The guide shows you how to grant access by defining and applying IAM policies to roles and resources. Additionally, this guide explains how IAM works and how you can use IAM to control access for your users and workloads.
This AWS Security Token Service (AWS STS) documentation describes the API operations for you to programmatically assume roles in AWS. The documentation also provides sample requests, responses, and errors for the supported web service protocols.
This IAM section of the AWS CLI Command Reference describes the AWS CLI commands you can use to administer IAM. The section also provides syntax, options, and usage examples for each command.
This AWS STS section of the AWS CLI Command Reference documentation describes the AWS CLI commands that you can use to generate temporary security credentials. The section also provides syntax, options, and usage examples for each command.
The IAM API Reference describes in detail all the API operations for IAM. This documentation also provides sample requests, responses, and errors for the supported web services protocols.
Sample code and libraries: IAM-related sample code
Developer tools: Command line and GUI-based tools for use with IAM APIs
IAM discussion forum: Discussion forum for IAM-related topics
This hands on lab is broken into launching EC2 instances with tags, creating IAM identities, testing access for resources, and assigning IAM roles for EC2 instances.
In this workshop, learn how to use IAM Access Analyzer policy validation feature, build a CI/CD pipeline using AWS services, and incorporate IAM Access Analyzer policy validation checks into your CI/CD pipeline.
In the workshop, you will learn how to utilize IAM Roles Anywhere to secure your on-premise or hybrid workloads by using AWS security services like AWS Key Management Service (AWS KMS), AWS Secrets Manager, and AWS Certificate Manager Private CA (ACM Private CA).
This workshop will allow you to dive deep on AWS IAM Roles Anywhere and have a better understanding on how to get access to temporary IAM credentials for workloads outside of AWS.
Featured blog posts
- How to monitor and query IAM resources at scale - Part 1
- How to monitor and query IAM resources at scale - Part 2
- How to use policies to restrict where EC2 instance credentials can be used from
- How to visualize IAM Access Analyzer policy validation findings with Amazon Quicksight
- How to prioritize IAM Access Analyzer findings
- Extend AWS IAM roles to workloads outside of AWS with IAM Roles Anywhere
- How to use AWS Private Certificate Authority short-lived certificate mode
- Using AWS Distro for OpenTelemetry and IAM Roles Anywhere on-premises to ingest metrics into Amazon Managed Service for Prometheus