30. Cloud and AWS Security

30.2 IAM Done Right

By Ravindra Bagale · Last updated: 27 September 2026

IAM (Identity and Access Management) is the front door of your account. Get this right and most attacks fail.

1. Lock the root user. The root user (your sign-up email) can do everything, including closing the account.

• Enable MFA on root (IAM console, Security credentials, Assign MFA device).
• Delete any root access keys. Root should never have keys.
• Use root only for billing and account-level tasks; do daily work as an IAM user or through IAM Identity Center.

2. MFA for every human. A stolen password alone should never be enough.

3. Least privilege. Give only the permissions a job needs. Compare:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["s3:GetObject", "s3:PutObject"],
    "Resource": "arn:aws:s3:::reels-media-pune/*"
  }]
}

This policy lets the app read and write objects in one bucket. Attaching AdministratorAccess to the app instead would let one bug in your PHP code hand an attacker your whole account.

4. Roles, not access keys. An EC2 instance should get permissions from an IAM role (you did this in Chapter 16), which gives short-lived credentials that rotate automatically. Long-lived access keys in code or ~/.aws/credentials on a server are the most common way cloud accounts get stolen.

5. Review regularly. IAM, Credential report (download CSV) shows who has MFA, old passwords and unused keys. IAM Access Analyzer flags resources shared outside your account.

aws sts get-caller-identity                     # who am I right now?
aws iam generate-credential-report
aws iam get-credential-report --query Content --output text | base64 -d > cred-report.csv
aws iam list-access-keys --user-name dev-sanket  # any old keys?