https://www.microdegree.work/static/js/1070.4cf0605b.chunk.js

1"use strict";(self.webpackChunkmicrodegree=self.webpackChunkmicrodegree||[]).push([[1070],{41477:function(e,s,t){t.d(s,{D:function(){return l},I:function(){return r}});t(72791);var a=t(60328),i=t(5413),n=t(80184),r=function(){return(0,n.jsx)("div",{className:"md:hidden w-full mb-6 overflow-hidden rounded-lg",children:(0,n.jsx)("a",{href:"https://www.microdegree.work/learning",target:"_blank",rel:"noopener noreferrer","aria-label":"Explore MicroDegree FREE E-learning programs",children:(0,n.jsx)("img",{src:i,alt:"Explore MicroDegree FREE E-learning programs",className:"block w-full h-auto"})})})},l=function(){return(0,n.jsx)("aside",{className:"hidden md:block sticky top-[100px] self-start h-fit",children:(0,n.jsx)("a",{href:"https://www.microdegree.work/learning",target:"_blank",rel:"noopener noreferrer","aria-label":"Explore MicroDegree learning programs",className:"block w-full",children:(0,n.jsx)("picture",{children:(0,n.jsx)("img",{src:a,alt:"Explore MicroDegree learning programs",className:"block w-full max-h-[calc(100vh-120px)] object-contain"})})})})}},71070:function(e,s,t){t.r(s);var a=t(74165),i=t(15861),n=t(93433),r=t(29439),l=t(72791),o=t(41477),c=t(18711),d=t(80184),h=function(e){var s=e.src,t=e.alt;return(0,d.jsx)("div",{className:"relative w-full h-[230px] sm:h-[400px] mb-10 overflow-hidden rounded-lg shadow-md",children:(0,d.jsx)("img",{src:s,alt:t,className:"absolute inset-0 w-full h-full object-cover object-center",loading:"lazy"})})};s.default=function(){(0,l.useEffect)((function(){window.scrollTo({top:0,left:0,behavior:"instant"});var e=document.createElement("script");return e.type="application/ld+json",e.innerHTML=JSON.stringify({"@context":"https://schema.org","@type":"BlogPosting",headline:"How Does AWS IAM Work? A Practical Guide to Users, Roles, Policies & Permissions",author:{"@type":"Organization",name:"MicroDegree"},datePublished:"2026-09-12",description:"Learn how AWS IAM works \u2014 users, groups, roles, and policies explained with real examples. A practical guide to AWS permissions for IT professionals.",publisher:{"@type":"Organization",name:"MicroDegree"},mainEntityOfPage:{"@type":"WebPage","@id":"https://microdegree.work/aws-iam-explained-users-roles-policies-permissions"}}),document.head.appendChild(e),function(){e.remove()}}),[]);var e=(0,l.useState)(!1),s=(0,r.Z)(e,2),t=s[0],m=s[1],u=(0,l.useState)(0),p=(0,r.Z)(u,2),x=p[0],g=p[1],b=(0,l.useState)(new Set),f=(0,r.Z)(b,2),y=f[0],w=f[1],j=(0,l.useState)([]),A=(0,r.Z)(j,2),v=A[0],N=A[1];(0,l.useEffect)((function(){fetch("/blogs.json").then((function(e){return e.json()})).then((function(e){var s=new Date("July 1, 2026"),t=e.filter((function(e){return new Date(e.date)>s&&"/aws-iam-explained-users-roles-policies-permissions"!==e.link})).reverse().slice(0,12);N(t)})).catch((function(e){return console.error("Failed to load related blogs:",e)}))}),[]),(0,l.useEffect)((function(){var e=function(){var e=window.innerHeight,s=document.documentElement.scrollHeight,t=window.pageYOffset||document.documentElement.scrollTop;g(t/(s-e)*100)};return window.addEventListener("scroll",e),function(){return window.removeEventListener("scroll",e)}}),[]),(0,l.useEffect)((function(){var e=new IntersectionObserver((function(e){e.forEach((function(e){e.isIntersecting&&w((function(s){return new Set([].concat((0,n.Z)(s),[e.target.id]))}))}))}),{threshold:0,rootMargin:"0px 0px -100px 0px"}),s=document.querySelectorAll("[data-blog-section]");return s.forEach((function(s){return e.observe(s)})),function(){s.forEach((function(s){return e.unobserve(s)}))}}),[]);var I=function(){var e=(0,i.Z)((0,a.Z)().mark((function e(){var s,t;return(0,a.Z)().wrap((function(e){for(;;)switch(e.prev=e.next){case 0:if(s=window.location.href,t=document.title,"Hey, checkout our latest blogs \ud83d\ude80\n",!navigator.share){e.next=14;break}return e.prev=4,e.next=7,navigator.share({title:t,text:"Hey, checkout our latest blogs \ud83d\ude80\n",url:s});case 7:e.next=12;break;case 9:e.prev=9,e.t0=e.catch(4),"AbortError"!==e.t0.name&&console.error("Error sharing:",e.t0);case 12:e.next=23;break;case 14:return e.prev=14,e.next=17,navigator.clipboard.writeText(s);case 17:alert("Article link copied to clipboard!"),e.next=23;break;case 20:e.prev=20,e.t1=e.catch(14),alert("Failed to copy the link");case 23:case"end":return e.stop()}}),e,null,[[4,9],[14,20]])})));return function(){return e.apply(this,arguments)}}(),M=function(e){return"mb-16 transition-all duration-700 ".concat(y.has(e)?"opacity-100 translate-y-0":"opacity-0 translate-y-4")},S=function(e){return function(s){var t;s.preventDefault(),null===(t=document.getElementById(e))||void 0===t||t.scrollIntoView({behavior:"smooth"})}};

1return(0,d.jsxs)(d.Fragment,{children:[(0,d.jsx)(c.Z,{title:"AWS IAM Explained: How Users, Roles & Policies Work",description:"Learn how AWS IAM works \u2014 users, groups, roles, and policies explained with real examples. A practical guide to AWS permissions for IT professionals.",canonical:"https://www.microdegree.work/aws-iam-explained-users-roles-policies-permissions"}),(0,d.jsxs)("div",{className:"relative p-4 min-h-screen",children:[(0,d.jsx)("div",{className:"fixed top-0 left-0 w-full h-1 bg-gray-200 z-50",children:(0,d.jsx)("div",{className:"h-full bg-gradient-to-r from-blue-500 to-blue-700 transition-all duration-150 ease-out",style:{width:"".concat(x,"%")}})}),(0,d.jsx)("div",{className:"max-w-6xl mx-auto p-6 text-left xl:shadow-lg 2xl:shadow-md lg:shadow-md md:shadow-md",children:(0,d.jsxs)("div",{className:"grid grid-cols-1 gap-8 leading-normal text-left md:grid-cols-[minmax(0,1fr)_320px] lg:grid-cols-[minmax(0,1fr)_380px] items-start",children:[(0,d.jsxs)("div",{className:"min-w-0",children:[(0,d.jsx)("nav",{className:"text-sm mb-2",children:(0,d.jsxs)("ol",{className:"list-reset flex",children:[(0,d.jsx)("li",{children:(0,d.jsx)("a",{href:"/blog",className:"text-blue-600 hover:underline hover:text-blue-800",children:"Blogs"})}),(0,d.jsx)("li",{children:(0,d.jsx)("span",{className:"mx-2",children:"/"})}),(0,d.jsx)("li",{className:"font-medium",children:"Cloud"})]})}),(0,d.jsx)("h1",{className:"font-semibold text-4xl mt-2",children:"How Does AWS IAM Work? A Practical Guide to Users, Roles, Policies & Permissions"}),(0,d.jsxs)("div",{className:"py-5 text-sm flex flex-wrap items-center gap-3",children:[(0,d.jsxs)("span",{className:"flex flex-row items-center",children:[(0,d.jsx)("svg",{className:"text-blue-600 mr-1",fill:"currentColor",height:"13px",width:"13px",viewBox:"0 0 512 512",children:(0,d.jsx)("path",{d:"M256,0C114.837,0,0,114.837,0,256s114.837,256,256,256s256-114.837,256-256S397.163,0,256,0z M277.333,256 c0,11.797-9.536,21.333-21.333,21.333h-85.333c-11.797,0-21.333-9.536-21.333-21.333s9.536-21.333,21.333-21.333h64v-128 c0-11.797,9.536-21.333,21.333-21.333s21.333,9.536,21.333,21.333V256z"})}),"September 12, 2026"]}),(0,d.jsxs)("span",{className:"flex flex-row items-center hover:text-blue-600",children:[(0,d.jsxs)("svg",{className:"text-blue-600 mr-1",fill:"currentColor",height:"16px",viewBox:"0 0 24 24",children:[(0,d.jsx)("path",{fill:"currentColor",d:"M12 12c2.21 0 4-1.79 4-4s-1.79-4-4-4-4 1.79-4 4 1.79 4 4 4zm0 2c-2.67 0-8 1.34-8 4v2h16v-2c0-2.66-5.33-4-8-4z"}),(0,d.jsx)("path",{d:"M0 0h24v24H0z",fill:"none"})]}),"MicroDegree"]}),(0,d.jsxs)("button",{onClick:I,className:"flex flex-row items-center text-blue-600 hover:text-blue-800 transition-all duration-300 hover:scale-105 active:scale-95 transform",children:[(0,d.jsx)("svg",{className:"text-blue-600 mr-1",fill:"currentColor",height:"16px",viewBox:"0 0 24 24",children:(0,d.jsx)("path",{d:"M18 16.08c-.76 0-1.44.3-1.96.77L8.91 12.7c.05-.23.09-.46.09-.7s-.03-.47-.09-.7l7.02-4.11C16.56 7.63 17.24 8 18 8c1.66 0 3-1.34 3-3s-1.34-3-3-3-3 1.34-3 3c0 .24.04.47.09.7l-7.02 4.11C7.44 9.3 6.76 9 6 9c-1.66 0-3 1.34-3 3s1.34 3 3 3c.76 0 1.44-.3 1.96-.77l7.12 4.15c-.05.21-.08.43-.08.66 0 1.52 1.23 2.75 2.75 2.75s2.75-1.23 2.75-2.75-1.23-2.75-2.75-2.75z"})}),"Share this article"]})]}),(0,d.jsx)("hr",{className:"my-4"}),(0,d.jsx)(h,{src:"https://blogs-mainwebsite.s3.ap-south-1.amazonaws.com/Blog+106/Image+1.webp",alt:"AWS IAM users, roles, and policies architecture diagram"}),(0,d.jsx)("p",{className:"text-base leading-8 my-5",children:"Every cloud security incident usually traces back to one thing: who had access to what. AWS IAM is the service that decides who can log in, what they can touch, and what they're blocked from doing across your AWS account."}),(0,d.jsx)("p",{className:"text-base leading-8 my-5",children:"This guide explains how AWS IAM works \u2014 users, groups, roles, and policies \u2014 with practical examples for setting AWS permissions correctly."}),(0,d.jsxs)("div",{className:"bg-gradient-to-br from-blue-50 to-blue-100 p-6 rounded-xl w-full max-w-6xl mx-auto 

1shadow-lg mb-10 border border-blue-100 hover:shadow-2xl transition-all duration-300",children:[(0,d.jsxs)("div",{className:"flex justify-between items-center cursor-pointer select-none group",onClick:function(){return m(!t)},children:[(0,d.jsx)("h2",{className:"text-xl font-semibold text-gray-800 group-hover:text-blue-600 transition-colors duration-200",children:"Table of Contents"}),(0,d.jsx)("span",{className:"transform transition-all duration-300 text-blue-600 ".concat(t?"rotate-180":""," group-hover:scale-110"),children:"\u25bc"})]}),t&&(0,d.jsx)("ul",{className:"list-disc pl-6 mt-4 space-y-2 animate-fadeIn",children:[{id:"what-is-iam",label:"What Is AWS IAM?"},{id:"how-iam-works",label:"How Does AWS IAM Work?"},{id:"core-components",label:"Core Components of AWS IAM"},{id:"iam-users-groups",label:"Understanding IAM Users and Groups"},{id:"iam-roles",label:"What Are AWS IAM Roles?"},{id:"iam-policies",label:"How IAM Policies Control AWS Permissions"},{id:"permission-evaluation",label:"How AWS Evaluates IAM Permissions"},{id:"practical-example",label:"Practical AWS IAM Example"},{id:"best-practices",label:"AWS IAM Best Practices"}].map((function(e){var s=e.id,t=e.label;return(0,d.jsx)("li",{children:(0,d.jsx)("a",{href:"#".concat(s),onClick:S(s),className:"block hover:bg-blue-100 hover:text-blue-700 px-3 py-2 rounded-lg transition-all duration-200 cursor-pointer transform hover:translate-x-1 hover:shadow-sm",children:t})},s)}))})]}),(0,d.jsxs)("section",{id:"what-is-iam","data-blog-section":!0,className:M("what-is-iam"),children:[(0,d.jsx)("h2",{className:"text-2xl font-semibold my-5 text-blue-600 border-l-4 border-blue-500 pl-4",children:"What Is AWS IAM?"}),(0,d.jsx)("p",{className:"text-base leading-8 my-5",children:"AWS IAM (Identity and Access Management) is the AWS service that controls who can access your AWS account and what actions they're allowed to perform. Instead of every user having full access to everything, IAM lets you define precise permissions for each person, application, or service."}),(0,d.jsx)("p",{className:"text-base leading-8 my-5",children:"IAM in AWS is a global service \u2014 it isn't tied to a specific region. An IAM user, group, or role you create is available across every region from a single control point, and IAM itself is free to use; you only pay for the AWS resources it controls."}),(0,d.jsx)("p",{className:"text-base leading-8 my-5",children:"IAM answers two questions for every request made to AWS:"}),(0,d.jsxs)("ul",{className:"list-disc pl-6 my-5 space-y-3 text-base leading-8 text-gray-700",children:[(0,d.jsx)("li",{children:"Who is making this request? (authentication)"}),(0,d.jsx)("li",{children:"Are they allowed to do this specific thing? (authorization)"})]})]}),(0,d.jsxs)("section",{id:"how-iam-works","data-blog-section":!0,className:M("how-iam-works"),children:[(0,d.jsx)("h2",{className:"text-2xl font-semibold my-5 text-blue-600 border-l-4 border-blue-500 pl-4",children:"How Does AWS IAM Work?"}),(0,d.jsx)("p",{className:"text-base leading-8 my-5",children:"AWS IAM works by separating authentication from authorization, then using policies to connect the two."}),(0,d.jsx)("p",{className:"text-base leading-8 my-5",children:"Authentication confirms identity, whether through a username and password or an application authenticating via a role. Authorization happens next \u2014 AWS checks whether that identity has permission to perform the specific action on the specific resource requested."}),(0,d.jsx)("p",{className:"text-base leading-8 my-5",children:"The connection between identities and actions is made through IAM policies \u2014 documents that state what's allowed or denied. You attach policies to users, groups, or roles, and AWS uses them to make an access decision on every request."}),(0,d.jsx)("p",{className:"text-base leading-8 my-5",children:"Underneath this sits the default deny model: an IAM identity has zero permissions until a policy explicitly grants them. You start locked down and open up access deliberately, one permission at a time."}),(0,d.jsx)(h,{src:"https://blogs-mainwebsite.s3.ap-south-1.amazonaws.com/Blog+106/Image+2.webp",alt:"How AWS IAM authentication and authorization work together"})]}),(0,d.jsxs)("section",{id:"core-components","data-blog-section":!0,className:M("core-components"),children:[(0,d.jsx)("h2",{className:"text-2xl font-semibold my-5 text-blue-600 border-l-4 border-blue-500 pl-4",children:"Core Components of AWS IAM"}),(0,d.jsxs)("ul",{className:"list-disc pl-6 my-5 space-y-3 text-base leading-8 text-gray-700",children:[(0,d.jsxs)("li",{children:[(0,d.jsx)("span",{className:"font-semibold",children:"IAM Users"})," \u2014 Individual identities for people or applications that need long-term access."]}),(0,d.jsxs)("li",{children:[(0,d.jsx)("span",{className:"font-semibold",children:"IAM Groups"})," \u2014 Collections of users that share the same permissions, making bulk management easier."]}

1),(0,d.jsxs)("li",{children:[(0,d.jsx)("span",{className:"font-semibold",children:"AWS IAM Roles"})," \u2014 Identities with temporary credentials, typically assumed by services, applications, or federated users."]}),(0,d.jsxs)("li",{children:[(0,d.jsx)("span",{className:"font-semibold",children:"IAM Policies"})," \u2014 JSON documents that define exactly what actions are allowed or denied."]}),(0,d.jsxs)("li",{children:[(0,d.jsx)("span",{className:"font-semibold",children:"Permissions and Permission Boundaries"})," \u2014 The actual access granted through policies, with boundaries acting as a ceiling on the maximum permissions an identity can ever have."]})]}),(0,d.jsx)("p",{className:"text-base leading-8 my-5",children:"Most real-world AWS permission issues come from mixing these up \u2014 like using a long-term IAM user where a temporary role would have been safer."})]}),(0,d.jsxs)("section",{id:"iam-users-groups","data-blog-section":!0,className:M("iam-users-groups"),children:[(0,d.jsx)("h2",{className:"text-2xl font-semibold my-5 text-blue-600 border-l-4 border-blue-500 pl-4",children:"Understanding IAM Users and Groups"}),(0,d.jsx)("h3",{className:"text-xl font-semibold my-4 text-gray-800",children:"When to Create IAM Users"}),(0,d.jsx)("p",{className:"text-base leading-8 my-5",children:"Create an IAM user when an application or service needs a standing identity that can't use temporary credentials \u2014 for example, a legacy tool that only supports static access keys. For people logging into the console day-to-day, AWS recommends IAM Identity Center (AWS SSO) instead, since it issues short-lived credentials tied to your existing directory. Reserve IAM users for cases where SSO isn't an option."}),(0,d.jsx)("h3",{className:"text-xl font-semibold my-4 text-gray-800",children:"Why Groups Simplify Permission Management"}),(0,d.jsx)("p",{className:"text-base leading-8 my-5",children:"Attaching policies to individual users doesn't scale. IAM groups solve this: attach a policy once to the group, then add users to it. Update the group when permissions change, and every member updates automatically \u2014 which also speeds up onboarding and offboarding."}),(0,d.jsx)("h3",{className:"text-xl font-semibold my-4 text-gray-800",children:"Best Practice: Avoid Using the Root User for Daily Tasks"}),(0,d.jsx)("p",{className:"text-base leading-8 my-5",children:"The root user has unrestricted access to everything, including billing and account closure. Reserve it for tasks that specifically require it, such as changing your support plan. Enable MFA on it, then use IAM users or roles for everything else."})]}),(0,d.jsxs)("section",{id:"iam-roles","data-blog-section":!0,className:M("iam-roles"),children:[(0,d.jsx)("h2",{className:"text-2xl font-semibold my-5 text-blue-600 border-l-4 border-blue-500 pl-4",children:"What Are AWS IAM Roles?"}),(0,d.jsx)("p",{className:"text-base leading-8 my-5",children:"AWS IAM roles provide temporary security credentials instead of permanent ones. A role isn't tied to one person and has no password or long-term access keys \u2014 anyone or anything trusted to assume it gets short-lived credentials that expire automatically."}),(0,d.jsx)("h3",{className:"text-xl font-semibold my-4 text-gray-800",children:"Common IAM role use cases:"}),(0,d.jsxs)("ul",{className:"list-disc pl-6 my-5 space-y-3 text-base leading-8 text-gray-700",children:[(0,d.jsxs)("li",{children:[(0,d.jsx)("span",{className:"font-semibold",children:"EC2 accessing S3"})," \u2014 An IAM role attached to the instance provides temporary credentials, instead of storing access keys on it."]}),(0,d.jsxs)("li",{children:[(0,d.jsx)("span",{className:"font-semibold",children:"Lambda accessing DynamoDB"})," \u2014 A Lambda function assumes an execution role scoped to exactly what it needs."]}),(0,d.jsxs)("li",{children:[(0,d.jsx)("span",{className:"font-semibold",children:"Cross-account access"})," \u2014 Roles let an identity in one AWS account securely access resources in another, without duplicating IAM users."]}),(0,d.jsxs)("li",{children:[(0,d.jsx)("span",{className:"font-semibold",children:"Federation and SSO"})," \u2014 Roles let users authenticated through an external identity provider access AWS without a separate IAM user per employee."]})]})]}),(0,d.jsxs)("section",{id:"iam-policies","data-blog-section":!0,className:M("iam-policies"),children:[(0,d.jsx)("h2",{className:"text-2xl font-semibold my-5 text-blue-600 border-l-4 border-blue-500 pl-4",children:"How IAM Policies Control AWS Permissions"}),(0,d.jsx)("p",{className:"text-base leading-8 my-5",children:"An IAM policy is a JSON document that defines what's allowed or denied. Every policy statement typically includes:"}),(0,d.jsxs)("ul",{className:"list-disc pl-6 my-5 space-y-3 text-base leading-8 text-gray-700",children:[(0,d.jsxs)("li",{children:[(0,d.jsx)("span",{className:"font-semibold",children:"Effect"})," \u2014 Allow or Deny."]}),(0,d.jsxs)("li",{children:[(0,d.jsx)("span",{className:"font-semibold",children:"Action"})," \u2014 The specific API action, such as s3:GetObject or ec2:StartInstances."]}),(0,d.jsxs)("li",{children:[(0,d.jsx)("span",{className:"font-semibold",children:"Resource"})," \u2014 The AWS resource the action applies to, identified by its ARN."]}),(0,d.jsxs)("li",{children:[(0,d.jsx)("span",{className:"font-semibold",children:"Condition"})," \u2014 Optional rules that further restrict when the statement applies, such as requiring MFA."]})]}),(0,d.jsx)("p",{className:"text-base leading-8 my-5",children:"Managed policies are standalone and reusable across multiple identities. Inline policies are embedded into a single user, group, or role and can't be reused \u2014 useful for one-off requirements, but harder to track at scale."}),(0,d.jsx)("p",{className:"text-base leading-8 my-5",children:"Here's a basic policy granting read-only access to one S3 bucket:"}),(0,d.jsx)("pre",{className:"bg-gray-900 text-gray-100 text-sm sm:text-base rounded-lg p-5 my-6 overflow-x-auto shadow-lg",children:(0,d.jsx)("code",{children:'{\n  "Version": "2012-10-17",\n  "Statement": [\n    {\n      "Effect": "Allow",\n      "Action": [\n        "s3:GetObject",\n        "s3:ListBucket"\n      ],\n      "Resource": [\n        "arn:aws:s3:::project-reports-bucket",\n        "arn:aws:s3:::project-reports-bucket/*"\n      ]\n    }\n  ]\n}'})}),(0,d.jsx)("p",{className:"text-base leading-8 my-5",children:"This allows the attached identity to list and read objects in project-reports-bucket only \u2014 no write, delete, or access to any other bucket."}),(0,d.jsx)("p",{className:"text-base leading-8 my-5",children:"Beyond identity-based policies like this one, resource-based policies (such as an S3 bucket policy), permission boundaries, and service control policies (SCPs) in AWS Organizations can also shape the final access an i

1dentity has."}),(0,d.jsx)(h,{src:"https://blogs-mainwebsite.s3.ap-south-1.amazonaws.com/Blog+106/Image+3.webp",alt:"AWS IAM policy structure showing effect, action, resource, and condition"})]}),(0,d.jsxs)("section",{id:"permission-evaluation","data-blog-section":!0,className:M("permission-evaluation"),children:[(0,d.jsx)("h2",{className:"text-2xl font-semibold my-5 text-blue-600 border-l-4 border-blue-500 pl-4",children:"How AWS Evaluates IAM Permissions"}),(0,d.jsxs)("ol",{className:"list-decimal pl-6 my-5 space-y-3 text-base leading-8 text-gray-700",children:[(0,d.jsxs)("li",{children:[(0,d.jsx)("span",{className:"font-semibold",children:"Default denial"})," \u2014 Every request starts as denied."]}),(0,d.jsxs)("li",{children:[(0,d.jsx)("span",{className:"font-semibold",children:"Explicit allow"})," \u2014 A matching Allow statement moves access toward being granted."]}),(0,d.jsxs)("li",{children:[(0,d.jsx)("span",{className:"font-semibold",children:"Explicit deny overrides allow"})," \u2014 A matching Deny statement anywhere in the evaluation wins, regardless of any Allow."]}),(0,d.jsxs)("li",{children:[(0,d.jsx)("span",{className:"font-semibold",children:"Multiple policies interact together"})," \u2014 AWS evaluates all attached policies at once. Access is granted only if there's at least one explicit allow and no explicit deny anywhere."]})]}),(0,d.jsx)("p",{className:"text-base leading-8 my-5",children:"This is why IAM troubleshooting often comes down to finding a hidden Deny statement somewhere in the policy chain."})]}),(0,d.jsxs)("section",{id:"practical-example","data-blog-section":!0,className:M("practical-example"),children:[(0,d.jsx)("h2",{className:"text-2xl font-semibold my-5 text-blue-600 border-l-4 border-blue-500 pl-4",children:"Practical AWS IAM Example"}),(0,d.jsxs)("p",{className:"text-base leading-8 my-5",children:[(0,d.jsx)("span",{className:"font-semibold",children:"Scenario:"})," A developer needs read-only access to a single S3 bucket holding application logs."]}),(0,d.jsxs)("ol",{className:"list-decimal pl-6 my-5 space-y-3 text-base leading-8 text-gray-700",children:[(0,d.jsx)("li",{children:"Create a group, such as LogsReadOnlyGroup, instead of attaching permissions to the user directly."}),(0,d.jsx)("li",{children:"Attach an IAM policy to the group granting s3:GetObject and s3:ListBucket, scoped to the ARN of the logs bucket."}),(0,d.jsx)("li",{children:"Add the developer's IAM user to the group."}),(0,d.jsx)("li",{children:"Test and validate \u2014 reading a file should succeed; deleting or uploading one should fail with an access denied error."})]}),(0,d.jsx)("p",{className:"text-base leading-8 my-5",children:"This keeps the setup reusable \u2014 the next developer who needs the same access just gets added to the group."})]}),(0,d.jsxs)("section",{id:"best-practices","data-blog-section":!0,className:M("best-practices"),children:[(0,d.jsx)("h2",{className:"text-2xl font-semibold my-5 text-blue-600 border-l-4 border-blue-500 pl-4",children:"AWS IAM Best Practices"}),(0,d.jsxs)("ul",{className:"list-disc pl-6 my-5 space-y-3 text-base leading-8 text-gray-700",children:[(0,d.jsxs)("li",{children:[(0,d.jsx)("span",{className:"font-semibold",children:"Apply least-privilege access"})," \u2014 Grant only the exact permissions a task needs."]}),(0,d.jsxs)("li",{children:[(0,d.jsx)("span",{className:"font-semibold",children:"Enable MFA"})," \u2014 On the root user and every IAM user with console access."]}),(0,d.jsxs)("li",{children:[(0,d.jsx)("span",{className:"font-semibold",children:"Use roles instead of long-term access keys"})," where possible, since credentials expire automatically."]}),(0,d.jsxs)("li",{children:[(0,d.jsx)("span",{className:"font-semibold",children:"Rotate and remove unused credentials"})," \u2014 Delete IAM users, keys, and roles no longer active."]}),(0,d.jsxs)("li",{children:[(0,d.jsx)("span",{className:"font-semibold",children:"Review permissions with IAM Access Analyzer"})," \u2014 It flags resources shared externally, such as public or cross-account S3 access."]}),(0,d.jsxs)("li",{children:[(0,d.jsx)("span",{className:"font-semibold",children:"Monitor activity with CloudTrail"}),", paired with AWS Config or Security Hub for ongoing compliance checks."]}),(0,d.jsxs)("li",{children:[(0,d.jsx)("span",{className:"font-semibold",children:"Prefer IAM Identity Center for human access"})," \u2014 Manage employee logins centrally with short-lived credentials."]})]})]}),(0,d.jsxs)("section",{id:"conclusion","data-blog-section":!0,className:M("conclusion"),children:[(0,d.jsx)("h2",{className:"text-2xl font-semibold my-5 text-blue-600 border-l-4 border-blue-500 pl-4",children:"Conclusion"}),(0,d.jsxs)("div",{className:"bg-gradient-to-r from-blue-600 to-blue-700 p-8 rounded-xl text-white shadow-xl hover:shadow-2xl transition-shadow duration-300",children:[(0,d.jsx)("p",{className:"text-base leading-8 my-5 text-white/90",children:"AWS IAM ties your AW

1S account together: users and groups manage your people, roles provide safe temporary access for applications, and policies define exactly what's allowed. The evaluation logic \u2014 default deny, explicit allow, explicit deny overrides all \u2014 keeps that predictable and auditable."}),(0,d.jsx)("p",{className:"text-base leading-8 my-5 text-white/90",children:"Audit your AWS account's IAM setup this week: check who has access to what, and tighten anything broader than it needs to be."})]})]}),(0,d.jsxs)("section",{id:"faqs","data-blog-section":!0,className:M("faqs"),children:[(0,d.jsx)("h2",{className:"text-2xl font-semibold my-5 text-blue-600 border-l-4 border-blue-500 pl-4",children:"FAQs"}),(0,d.jsx)("div",{className:"divide-y divide-gray-200 border border-gray-200 rounded-xl overflow-hidden shadow-sm mb-10",children:[{q:"What is AWS IAM used for?",a:"AWS IAM is used to control who can access your AWS account and what actions they're permitted to take. It manages authentication and authorization across every AWS service in your account."},{q:"How does AWS IAM work for users, roles, policies, and permissions?",a:"IAM users represent people or applications needing long-term access, while IAM roles provide temporary credentials for services and cross-account access. IAM policies define specific AWS permissions, and AWS evaluates them on every request to allow or deny it."},{q:"What is the difference between an IAM user and an IAM role?",a:"An IAM user has a permanent identity with a password or long-term access keys. An IAM role has no permanent credentials \u2014 it's assumed temporarily, making it safer for automated or cross-account access."},{q:"What is the difference between IAM policies and permissions?",a:"An IAM policy is the document that defines rules \u2014 what's allowed or denied. Permissions are the actual access an identity ends up with after AWS evaluates all attached policies together."},{q:"Is AWS IAM free to use?",a:"Yes. AWS IAM has no additional cost \u2014 you only pay for the AWS resources IAM identities interact with."},{q:"What happens if there's no explicit allow in an IAM policy?",a:"The request is denied. AWS IAM follows a default-deny model, so nothing is permitted unless a policy explicitly allows it."}].map((function(e,s){var t=e.q,a=e.a;return(0,d.jsxs)("details",{className:"group py-4 hover:bg-gray-50 px-4 transition-all duration-200 hover:shadow-sm",children:[(0,d.jsxs)("summary",{className:"flex items-center justify-between font-medium list-none cursor-pointer hover:text-blue-600 transition-colors duration-200",children:[(0,d.jsxs)("span",{children:["Q",s+1,": ",t]}),(0,d.jsx)("span",{className:"transition group-open:rotate-180 text-blue-600",children:"\u25bc"})]}),(0,d.jsx)("p",{className:"mt-3 text-gray-600 group-open:animate-fadeIn pl-2 leading-7",children:a})]},s)}))})]}),(0,d.jsx)("section",{id:"cta","data-blog-section":!0,className:M("cta"),children:(0,d.jsxs)("section",{className:"bg-gradient-to-br from-blue-50 to-blue-100 border border-blue-200 rounded-xl p-6 shadow-lg mb-10",children:[(0,d.jsxs)("p",{className:"text-base leading-8",children:["IAM is one of those AWS skills that separates people who can use AWS from people who can secure it. If you want to practice building IAM policies, roles, and permission structures hands-on, MicroDegree's"," ",(0,d.jsx)("a",{href:"/awsdevops",className:"font-semibold text-blue-700 hover:underline",children:"AWS and Cloud courses"})," ","walk through this with real-world labs."]}),(0,d.jsx)("p",{className:"text-base leading-8 my-5",children:"Explore the program and take the next step toward your Cloud and DevOps career."}),(0,d.jsx)("p",{className:"text-base leading-8 my-5 font-semibold text-blue-700",children:(0,d.jsx)("a",{href:"https://www.microdegree.work/demopage?utm_source=website&utm_medium=organic&utm_campaign=demo_page&utm_content=main_section",target:"_blank",rel:"noopener noreferrer",className:"hover:underline",children:"TAKE A FREE DEMO!!"})})]})}),(0,d.jsx)("div",{className:"w-full flex justify-center items-center mt-10 mb-10",children:(0,d.jsxs)("fieldset",{className:"text-xl w-full border-2 border-blue-400 rounded-xl px-6 py-6 bg-gradient-to-br from-blue-50 to-blue-50 shadow-lg hover:shadow-2xl transition-all duration-300",children:[(0,d.jsx)("legend",{className:"px-3 font-semibold text-blue-700 bg-white rounded-lg shadow-sm",children:"Also Read Blogs"}),(0,d.jsx)("div",{className:"flex flex-col gap-3 text-base font-medium leading-[1.5] mt-4",children:0===v.length?(0,d.jsx)("p",{className:"text-gray-500 px-3 py-2",children:"Loading related blogs..."}):v.map((function(e){return(0,d.jsx)("a",{href:"https://www.microdegree.work".concat(e.link),className:"text-blue-700 hover:text-blue-900 hover:bg-blue-100 px-3 py-2 rounded-lg transition-all duration-200 transform hover:translate-x-2",children:e.title},e.id)}))})]})})]}),(0,d.jsx)(o.D,{})]})})]})]})}},60328:function(e,s,t){e.exports=t.p+"static/media/elearning.0d63cc9b90ea074c4f30.webp"},5413:function(e,s,t){e.exports=t.p+"static/media/elearning1.109108e86cb9580599d0.webp"}}]);
2//# sourceMappingURL=1070.4cf0605b.chunk.js.map