Cloud Arena
Back to IAM & Security

AWS Identity and Access Management (IAM)

aws

Fine-grained access control, temporary credentials, and policy governance across all AWS resources.

IAM & SECURITY
•Amazon Web Services

Fine-grained access control, temporary credentials, and policy governance across all AWS resources.

Click any section above to jump directly to it
GCP ➔ AWS Bridge
Fast-Track Mental Model Translation

Coming from Google Cloud?

Compare with Google Cloud IAM

Both govern cloud access through roles and policies, but AWS uses JSON policy documents with explicit Allow/Deny statements, whereas GCP binds predefined or custom roles to members across a resource hierarchy.

What's Conceptually Identical
  • Enforce least-privilege security across cloud resources.
  • Role-based access and temporary credential issuance (AWS STS vs GCP Service Account Token Creator).
  • Condition-based access (time, IP, tags, MFA).
Key Architectural Shifts in AWS
  • Policy Syntax: AWS uses declarative JSON policies with explicit `Allow` and `Deny` statements; GCP uses role bindings (`roles/viewer`) attached to members.
  • Hierarchy: GCP enforces strict inheritance (Org > Folder > Project > Resource); AWS uses Account boundaries with SCP guardrails.
  • Deny Handling: AWS explicit Deny overrides any Allow across all policies; GCP Deny policies were introduced as a separate overlay.
Syntax & Command Translator
Create Role with Trust Policy
GCP:gcloud iam roles create customRole --project=my-proj --permissions=storage.objects.get
AWS:aws iam create-role --role-name AppRole --assume-role-policy-document file://trust.json

What is AWS Identity and Access Management (IAM)?

AWS Identity and Access Management (IAM) is a foundational web service that helps you securely control access to AWS resources. With IAM, you centrally manage permissions that control which AWS resources users can access, who can be authenticated (signed in) and authorized (have permissions) to use resources, and automate credential delivery using temporary AWS STS credentials.

Decision Guide: When to Choose This Service

When to Use AWS Identity and Access Management (IAM)

Use AWS IAM to define least-privilege permissions, grant temporary access via IAM Roles, govern multi-account AWS Organizations with SCPs, and authenticate human and machine workloads.

When NOT to Use (Recommended Alternatives)

Do NOT use AWS IAM for end-user application authentication and user sign-up in mobile/web applications (use Amazon Cognito).

Core Architectural Pillars

Policy Evaluation Logic

Default Deny > Explicit Deny > Explicit Allow > Default Deny.

IAM Roles & STS

Temporary credentials issued dynamically via AWS STS, eliminating hardcoded access keys.

Trust Policy vs Permission Policy

Trust policies govern WHO can assume a role; permission policies govern WHAT the role can do.

Service Control Policies (SCPs)

Organization-wide permission guardrails acting as maximum privilege boundaries.

Permission Boundaries

Advanced feature that sets the maximum permissions an IAM entity can have.