A first-principles approach: AWS Identity and Access Management (IAM)
summary
A practical tour of IAM from first principles that shows how authentication and authorization actually work: STS issues short‑term creds via assumeRole to EC2, Lambda, Roles Anywhere or OIDC/SAML users; the SDK/CLI signs requests (access key, signature, session token) and services call the regional IAM data plane to fetch principal properties and evaluate policies. Concrete examples include using the JS V3 SDK and CLI to call S3:GetObject and s3:ListBucket, how a missing prefix condition causes an access denied, resource‑based (bucket) policies, IAM Identity Center mapping, ABAC tags, Organizations and Service Control Policies.
AI-written summary · about
chapters (9)
- 0:00Introduction to IAM
- 2:29History of AWS IAM
- 10:18IAM roles and principals
- 18:40IAM Identity Center explained
- 23:02Authentication with IAM credentials
- 32:40Authorization and policy matching
- 40:10Writing IAM policies step-by-step
- 47:33Cross-account access with policies
- 54:35Next steps and resources
related talks
25mGetting started with AWS Identity Services
01h 02mWhy IAM is the new perimeter, and how to govern it
23mGetting started with identity on AWS
28mIdentity Services on AWS
28mYour journey to temporary credentials in the cloud
37mLocking Down the Security of IAM
01h 00mAWS Identity Workshop
55mUsers and their data: Modern access and audit patterns on AWS