> For the complete documentation index, see [llms.txt](https://gchandra.gitbook.io/data-warehousing/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gchandra.gitbook.io/data-warehousing/cloud/aws/iam.md).

# IAM

Identity Access Management

<figure><img src="https://2629735788-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3G2NQEHaUSzehWzaKvXK%2Fuploads%2FofDmusxAh4Iq2LQQMerV%2Faws_iam.jpg?alt=media&amp;token=d2b04166-e1f8-4e1f-b49d-590a45ad4758" alt=""><figcaption><p>Src: aws</p></figcaption></figure>

ARN: Amazon Resource Name

Users - Individual Person / Application

Groups - Collection of IAM Users

Policies - Policy sets permission/control access to AWS resources. Policies are stored in AWS as JSON documents.

A Policy can be attached to multiple entities (users, groups, and roles) in your AWS account.

Multiple Policies can be created and attached to the user.

Roles - Set of permissions that define what actions are allowed and denied by an entity in the AWS console. Similar to a user, it can be accessed by any type of entity.

```
// Examples of ARNs

arn:aws:s3:::my_corporate_bucket/*

arn:aws:s3:::my_corporate_bucket/Development/*

arn:aws:iam::123456789012:user/chandr34

arn:aws:iam::123456789012:group/bigdataclass

arn:aws:iam::123456789012:group/*
```

### **Types of Policies**

***Identity-based policies**:* Identity-based policies are **attached to an IAM user, group, or role (identities)**. These policies control what actions an identity can perform, on which resources, and under what conditions.

***Resource-based policies**:* Resource-based policies are **attached to a resource** such as an Amazon S3 bucket. These policies control what actions a specified principal can perform on that resource and under what conditions.

***Permission Boundary:*** You can use an *AWS-managed policy* or a *customer***-***managed policy* to set the boundary for an IAM entity (user or role). A permissions boundary is an advanced feature for using a managed policy to set the maximum permissions that an identity-based policy can grant to an IAM entity.

***Inline Policies:*** Policies that are embedded in an IAM identity. Inline policies maintain a strict one-to-one relationship between a policy and an identity. They are deleted when you delete the identity.