Phase1 Cloud Iac

IAM Basics

Introduction

AWS Identity and Access Management (IAM) controls who can do what in your AWS account. Before you can automate anything — CI/CD pipelines, Terraform deployments, model training jobs — you need to understand how AWS decides whether to allow or deny an action.

Why This Matters

As a test automation engineer, you're used to running scripts with whatever permissions your local machine has. In cloud environments, every action requires explicit permission. Real-world scenario: Your CI/CD pipeline needs to push Docker images to ECR and deploy to EKS. If you use your personal credentials (bad practice) and leave the company, everything breaks. If you create an overly permissive role ("allow everything"), you've created a security risk. Understanding IAM lets you give systems exactly the permissions they need — no more, no less. This is called the Principle of Least Privilege, and it's fundamental to secure infrastructure.

Tasks

Log into AWS Console and navigate to IAM

Hint: Search for 'IAM' in the AWS console search bar

Find and read through your own user's permissions

Hint: Click on Users → your username → Permissions tab

Identify what policies are attached to your user (managed vs inline)

Create a new IAM user called 'test-automation-user' with no permissions

Attach the 'AmazonS3ReadOnlyAccess' managed policy to that user

Create an access key for the test user (you'll delete this shortly)

Using AWS CLI with the test user's credentials, try to list S3 buckets

Hint: aws s3 ls --profile test-automation-user

Try to create an S3 bucket with the test user — observe the permission denied error

Delete the test user and its access key (cleanup)

Check Understanding

AI Assistant

In one sentence, what is IAM in AWS?

IAM (Identity and Access Management) is AWS’s built-in authentication and authorization system that acts as the security gatekeeper for every AWS API call, controlling exactly which users, applications, or AWS services are allowed to perform specific actions (like launching a server or reading a database) on specific AWS resources, much like the login and role-based access control logic you would implement in a Python app to restrict what different users can do inside your software.

In one short sentence, what is IAM?

IAM is AWS’s identity and access management service that controls which users, services, or applications can perform specific actions on AWS resources.