AWS Accounts, Users, Groups, Roles, Policies

Below is a graphical representation of the key components of Identity Access Mangement in AWS:

  • Organization / root / management account can have multiple other accounts

  • An account can have Users, Groups, Roles and Policies

  • Users can be members of Groups and Groups can contain Users

  • Role is a secure way to grant termporary permissions to trusted entities:

    • Another AWS account (yours or 3rd party's)

    • AWS service

    • Web Identity

    • SAML Federation

    • All of the above mentioned trusted entities can assume a Role given they have the permission sts:AssumeRole

  • Policies signify what can/can't be done with resources (i.e EC2 instance, image, network interface, security group, etc.). Policies are defined as JSON objects

  • Level of access that a User, Group or a Role (identities) has on certain resources, is defined by Policies that are attached to said identities