🔐 AWS Identity and Access Management (IAM) in AWS

April 15, 2026 by [email protected]

IAM is a service provided by Amazon Web Services that helps you securely control access to your AWS resources.

📖 Simple Definition

👉 IAM = Identity + Access Control System

• Identity → Who (user/role)
• Access → What they can do (permissions)

🔑 Core Components of IAM

👤 Users

• Individual accounts for people or services
• Example: Admin, Developer

👥 Groups

• Collection of users
• Assign same permissions to multiple users

📜 Policies

• JSON documents that define permissions
• Example:
  • S3 read-only access
  • EC2 full access

🔄 Roles

• Provide temporary access
• Used by AWS services or external users
• No password required

🔐 How IAM Works

• Authentication (AuthN) → Verifies who you are (login)
• Authorization (AuthZ) → Defines what you can do

🧠 Real Example

• Developer → Only EC2 access
• Admin → Full access

👉 IAM controls these permissions

⚙️ One-Line Summary

👉 IAM = Control over who can access AWS and what they can do

🔐 AWS Multi-Factor Authentication Setup (Your Screen)

📍 You have 3 options:

1️⃣ Passkey or Security Key (Recommended by AWS)

👉 Uses:

• Fingerprint / Face unlock
• Physical security key (like USB key)

✔️ Most secure
❗ But needs supported device

2️⃣ Authenticator App ✅ (Best for you)

👉 Uses mobile app like:

• Google Authenticator
• Microsoft Authenticator

📱 Generates 6-digit code

👉 This is the easiest and most commonly used option

3️⃣ Hardware TOTP Token

👉 Physical device that generates code
❗ Rarely used (cost involved)

✅ What YOU should do (Recommended)

👉 Select:
✔️ Authenticator app

📲 Next Steps (Very Important)

1. Select Authenticator app
2. Click Next
3. You will see a QR code
4. Open Google Authenticator on your phone
5. Scan the QR code
6. Enter 2 consecutive codes
7. Click Add MFA

🧠 Pro Tip

👉 Name like MyMFASumit is fine 👍
👉 Always enable MFA for:

• Root account 🔥
• IAM users

⚠️ Common Mistake

❌ Entering wrong code
❌ Time mismatch in phone

👉 Fix:

• Turn on auto time sync in phone

⚙️ One-Line

👉 Choose Authenticator App → Scan QR → Enter OTP → Done

📲 Step-by-Step MFA Setup (Next Screen)

✅ Step 1: Select Authenticator App

👉 On your screen:

• “Passkey or security key” is currently selected ❌

👉 Change it to:
✔️ Authenticator app

✅ Step 2: Click Next

👉 Click the Next button (bottom/right)

📸 Step 3: QR Code Screen

👉 You will now see:

• A QR Code
• A manual setup key (backup)

📱 Step 4: Use Mobile App

On your phone:

1. Open Google Authenticator
2. Tap + (Add account)
3. Choose Scan QR Code
4. Scan the QR code from AWS

🔢 Step 5: Enter OTP Codes

After scanning:

• You will get a 6-digit code

👉 In AWS:

• Code 1 → Enter current OTP
• Wait ~30 seconds
• Code 2 → Enter new OTP

✅ Step 6: Add MFA

👉 Click:
✔️ Add MFA / Assign MFA

⚠️ Important Tips

• Turn ON auto time sync on your phone
• ❌ Don’t enter the same OTP twice
• 📌 Save the backup key

🧠 Final Result

👉 MFA will be enabled
👉 Next login = Password + OTP required 🔐

👉 Go ahead and click Next now

👉 Now click “Next” and move to the QR code screen.

📌 What to do AFTER clicking Next

When the next screen appears, you should see:

• QR Code
• 2 input boxes for OTP

👉 Then follow this:

📱 On your phone:

1. Open Google Authenticator
2. Tap + (Add)
3. Select Scan QR Code
4. Scan the QR shown on AWS

🔢 On AWS screen:

• Enter Code 1 → current OTP
• Wait ~30 seconds ⏳
• Enter Code 2 → next OTP

✅ Final Step:

👉 Click Add MFA

⚠️ If something goes wrong:

• OTP not working → Turn ON automatic time sync
• Code expired → wait for new code

t 👍 Let’s go step by step with interview + real use case + policy example 👇

🔥 IAM Interview Questions (with short answers)

1. What is IAM?

👉 AWS Identity and Access Management is a service to manage access to AWS resources securely.

2. What is the difference between Authentication and Authorization?

• Authentication (AuthN) → Who are you (login)
• Authorization (AuthZ) → What you can do (permissions)

3. What are IAM Policies?

👉 JSON documents that define permissions (Allow/Deny actions on resources)

4. What is an IAM Role?

👉 Provides temporary access without using username/password

5. What is MFA?

👉 Multi-Factor Authentication adds an extra security layer (OTP + password)

6. What is the principle of least privilege?

👉 Give minimum required permissions only

🛠️ Real DevOps Use Case

📌 Scenario:

You have a team:

• Developers
• DevOps Engineers
• Admin

✅ Solution using IAM:

• Create IAM Users
• Create Groups
  • Dev → EC2 + S3 access
  • DevOps → Full infra access
  • Admin → Full access

🔄 Use Roles:

• EC2 instance → access S3 using IAM Role
  👉 No need to store credentials (more secure)

📜 IAM Policy Example (JSON)

👉 Example: S3 Read-Only Access

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": "*"
    }
  ]
}

🧠 Explanation

• Effect → Allow/Deny
• Action → What actions allowed
• Resource → Which resource

🔐 Best Practices (Important 🔥)

• Enable MFA for all users
• Don’t use root account daily
• Use Roles instead of access keys
• Follow least privilege
• Rotate credentials regularly

⚙️ Final One-Line

👉 IAM = Security backbone of AWS (who + what control)

🔥 Scenario-Based Interview Questions

❓ Q1: Someone deleted an EC2 instance. How will you find who did it?

👉 Answer:
Use AWS CloudTrail to check logs

❓ Q2: Developer should access S3 but not delete objects. What will you do?

👉 Answer:
Create IAM policy → Allow read, Deny delete

❓ Q3: You don’t want to store credentials in EC2. What is the solution?

👉 Answer:
Use IAM Role

❓ Q4: CPU usage crosses 80%. How will you get notified?

👉 Answer:
Use Amazon CloudWatch alarm

❓ Q5: How to secure AWS account from hacking?

👉 Answer:

• Enable MFA
• Use strong password
• Least privilege
• Avoid root usage

🧠 Pro Tip (Interview Killer 🔥)

👉 Always say:

• “Use IAM for access control”
• “Use CloudTrail for auditing”
• “Use CloudWatch for monitoring”

⚙️ Final One-Line Summary

👉 IAM + CloudTrail + CloudWatch = Complete AWS Security + Monitoring System