# 2.1 IAM Introduction

IAM allows you to manage users and their level of access to the AWS console.

## IAM gives you:

* Centralised control of your AWS account.
* Shared access to your AWS account.
* Granular permissions.
* Identity Federation. (Facebook, Linkedin, etc.)
* Multifactor Authentication.
* Provide temporary access for users/devices and services where necessary. (Allow the app developed by you to access your AWS account)
* Allows you to set up your own password rotation policy .
* Integrates with many different AWS services.
* Support PCI DSS Compliance.

## Critical terms:

* Users: end users. A user can belong to multiple groups.
* Groups: a collection of users under one set of permissions, which makes those permissions easier to manage for those users. Groups cannot belong to other groups. Groups do not have security credentials, and cannot access web services directly.
* Roles: you create roles and can then assign them to AWS resources. It is an identity with permission policies that determine what the identity can and cannot do in AWS.
* Policies: a JSON document that defines one or more permissions (specify what a user/resource can do on AWS). Two permission types used by AWS are: User-based and Resource-based. A Policy mainly consists of:
  * Action: what actions you will allow. Each AWS service has its own set of actions.
  * Resources: which resources you allow the action on. Usually it is the ARN of the resources.
  * Effect: what the effect will be when the user requests access - either Allow or Deny.
  * ![](https://2556340799-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M5zQ5aJ_upQQkYs7m_V%2Fsync%2F2bd17f4c658ef2091cc22f4805d6a8b3384161a4.png?generation=1588054528083883\&alt=media)
* You can apply policies to users, groups and roles, they share the same policy document.

## Other related terms:

* Multifactor Authentication (MFA): AWS Multi-Factor Authentication (MFA) is a simple best practice that adds an extra layer of protection on top of your user name and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their user name and password (the first factor—what they know), as well as for an authentication code from their AWS MFA device (the second factor—what they have). Taken together, these multiple factors provide increased security for your AWS account settings and resources.
* Password rotation: If a password has been compromised, it is changed automatically and the old password no longer grants access.
* PCI DSS Compliance: The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards designed to ensure that ALL companies that accept, process, store or transmit credit card information maintain a secure environment.
*   Single Sign On (SSO): Single sign-on (SSO) is a property of access control of multiple related, yet independent, software systems. With this property, a user logs in with a single ID and password to gain access to a connected system or systems without using different usernames or passwords, or in some configurations seamlessly sign on at each system. This is typically accomplished using the Lightweight Directory Access Protocol (LDAP) and stored LDAP databases on (directory) servers. A simple version of single sign-on can be achieved over IP networks using cookies but only if the sites share a common DNS parent domain. Other shared authentication schemes include OAuth, OpenID, OpenID Connect and Facebook Connect. However, these authentication schemes require the user to enter their login credentials each time they access a different site or application so they are not to be confused with SSO.

    &#x20;To be precise, OAuth is not strictly an authentication scheme but an authorization protocol.
