What is AWS IAM?
Learn what AWS IAM is, how users, groups, roles, and policies control resource access, and how to explain least privilege clearly in an AWS interview.
Expected Interview Answer
AWS IAM (Identity and Access Management) is the service that controls who can authenticate into an AWS account and what actions they are authorized to perform, using users, groups, roles, and policies.
Users represent people or applications with long-term credentials, groups bundle users to apply permissions collectively, and roles provide temporary credentials that can be assumed by users, services, or federated identities without sharing long-lived keys. Policies are JSON documents that explicitly allow or deny specific actions on specific resources, and IAM evaluates all applicable policies to decide whether a request is permitted, with an explicit deny always overriding an allow. Best practice is to follow least privilege, use roles instead of long-lived access keys wherever possible, and enable multi-factor authentication for human users. IAM is global (not region-scoped) and underpins the shared responsibility model by letting customers control fine-grained access to every other AWS service.
- Centralized, fine-grained control over who can do what
- Temporary credentials via roles avoid long-lived key sprawl
- Least-privilege policies reduce blast radius of compromised credentials
- Groups simplify permission management at scale
- Integrates with every AWS service for consistent access control
AI Mentor Explanation
IAM is like a team's official accreditation system that issues passes stating exactly what each person can do — a bowler's pass lets you enter the field to bowl but not access the selectors' room. Coaches get a temporary matchday pass instead of a permanent key, and any pass explicitly marked 'denied' for the dressing room overrides all other access it might otherwise carry.
Step-by-Step Explanation
Step 1
Create identities
IAM users represent people or apps; groups bundle users for shared permissions.
Step 2
Prefer roles over long-lived keys
Roles issue temporary credentials that services or federated users assume instead of storing static keys.
Step 3
Attach policies
JSON policy documents explicitly allow or deny specific actions on specific resources.
Step 4
Evaluate least privilege
Grant only the minimum permissions needed, and remember explicit deny always wins over allow.
Step 5
Add MFA and monitoring
Enable multi-factor authentication for human users and audit access with tools like IAM Access Analyzer.
What Interviewer Expects
- Explains IAM as authentication plus authorization for AWS accounts
- Distinguishes users, groups, and roles, and when to use each
- Understands policies are JSON and explicit deny overrides allow
- Knows why roles/temporary credentials are preferred over long-lived keys
- Mentions least privilege and MFA as security best practices
Common Mistakes
- Confusing IAM roles with IAM users
- Assuming IAM policies are region-scoped when IAM is a global service
- Forgetting that an explicit deny always overrides an allow
- Hardcoding long-lived access keys into application code instead of using roles
Best Answer (HR Friendly)
“AWS IAM controls who can log into a company's cloud account and what they are allowed to do once inside, similar to giving employees keycards that only open the doors relevant to their job. It helps keep systems secure by making sure people and applications only have access to what they actually need.”
Code Example
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["s3:GetObject", "s3:ListBucket"],
"Resource": [
"arn:aws:s3:::skillveris-assets-demo",
"arn:aws:s3:::skillveris-assets-demo/*"
]
}
]
}Follow-up Questions
- What is the difference between an IAM user, group, and role?
- How does IAM decide the effective permissions when multiple policies apply?
- Why are IAM roles preferred over access keys for EC2 or Lambda?
- What is the principle of least privilege and how do you apply it?
- What is IAM Access Analyzer and what problem does it solve?
MCQ Practice
1. In IAM policy evaluation, what happens if one policy allows an action and another explicitly denies it?
IAM's evaluation logic always lets an explicit deny override any allow, regardless of policy order.
2. What is the main advantage of an IAM role over an IAM user with access keys?
Roles issue short-lived, automatically rotated temporary credentials, reducing the risk of long-term key leakage.
3. Is IAM a region-scoped or global AWS service?
IAM is a global service; users, groups, roles, and policies apply across all AWS regions in the account.
Flash Cards
What is AWS IAM? — The service controlling authentication and authorization for who can access AWS resources and what they can do.
IAM roles vs users? — Users hold long-term credentials; roles provide temporary credentials assumed by users, services, or federated identities.
What wins: allow or explicit deny? — An explicit deny always overrides any allow in IAM policy evaluation.
Is IAM region-scoped? — No, IAM is a global AWS service.