# AWS Identity and Access Management (IAM)

Cloud service · AWS. Updated 2026-11-12. Page: https://blowstack.com/tools/cloud-services-hub/aws-identity-and-access-management-(iam)

> AWS Identity and Access Management (IAM) is a cloud service that helps securely control access to AWS resources by allowing you to create and manage AWS users and groups, and use permissions to allow and deny their access to AWS resources.

Practice exams covering AWS Identity and Access Management (IAM): [ANS-C01 AWS Certified Advanced Networking - Specialty](https://blowstack.com/practice-exams/aws-certified-advanced-networking-specialty), [AIB-C01 (beta) AWS Certified AI Business Strategist](https://blowstack.com/practice-exams/aws-certified-ai-business-strategist), [AIF-C01 AWS Certified AI Practitioner](https://blowstack.com/practice-exams/aws-certified-ai-practitioner), [CLF-C02 AWS Certified Cloud Practitioner](https://blowstack.com/practice-exams/aws-certified-cloud-practitioner), [SOA-C03 AWS Certified CloudOps Engineer - Associate](https://blowstack.com/practice-exams/aws-certified-cloudops-engineer-associate), [DEA-C01 AWS Certified Data Engineer - Associate](https://blowstack.com/practice-exams/aws-certified-data-engineer-associate), [DVA-C02 AWS Certified Developer - Associate](https://blowstack.com/practice-exams/aws-certified-developer-associate), [DOP-C02 AWS Certified DevOps Engineer - Professional](https://blowstack.com/practice-exams/aws-certified-devops-engineer-professional), [AIP-C01 AWS Certified Generative AI Developer - Professional](https://blowstack.com/practice-exams/aws-certified-generative-ai-developer-professional), [MLA-C02 (beta) AWS Certified Machine Learning Engineer - Associate](https://blowstack.com/practice-exams/aws-certified-machine-learning-engineer-associate), [SCS-C03 AWS Certified Security - Specialty](https://blowstack.com/practice-exams/aws-certified-security-specialty), [SAA-C03 AWS Certified Solutions Architect - Associate](https://blowstack.com/practice-exams/aws-certified-solutions-architect-associate), [SAP-C02 AWS Certified Solutions Architect - Professional](https://blowstack.com/practice-exams/aws-certified-solutions-architect-professional).

## 9 key features of AWS Identity and Access Management (IAM)

AWS Identity and Access Management (IAM) provides fine-grained access control, identity federation, multi-factor authentication, integration with AWS services, centralized control, policy simulation tools, customizable password policies, and an Access Advisor for comprehensive and secure management of permissions and access within the AWS cloud.

1. **Fine-Grained Access Control**: AWS IAM permits users to grant and restrict access to AWS services and resources very precisely, allowing the assignment of different permissions for different users, roles, groups, and policies.
2. **Identity Federation**: IAM supports identity federation, enabling users to authenticate with a trusted external identity provider (IdP) and access AWS resources without requiring an AWS-specific user account.
3. **Multi-Factor Authentication (MFA)**: For enhanced security, IAM allows the activation of Multi-Factor Authentication, requiring users to present two or more separate credentials for accessing AWS resources.
4. **Integrated with AWS Services**: IAM is integrated seamlessly with other AWS services, ensuring that security and access policies are uniformly enforced across the AWS ecosystem.
5. **Centralized Control**: IAM provides a centralized way to manage users, security credentials (such as access keys), and permissions, offering full control over your AWS environment.
6. **Policy Simulation Tools**: AWS offers policy simulation tools within IAM, helping admins understand and refine permissions to ensure the right access levels are set before deploying changes.
7. **Customizable Password Rotation Policies**: IAM empowers administrators to enforce custom password policies, including password complexity requirements and rotation periods, enhancing security.
8. **Access Advisor**: The Access Advisor feature within IAM helps users and administrators identify unused permissions and tighten access controls, minimizing security risks.
9. **Credential Reports**: IAM can generate a credential report listing IAM users and the status of their credentials.

## Where AWS Identity and Access Management (IAM) is used

AWS Identity and Access Management (IAM) use cases include granular permissions management, secure application access to AWS resources without hard-coded credentials, the delegation of administrative tasks, enforcing multi-factor authentication for enhanced security, and secure cross-account resource access.

1. **Granular Access Control**: AWS IAM allows organizations to create and manage AWS users and groups, and use permissions to allow and deny their access to AWS resources. By applying granular permissions, businesses can adhere to the principle of least privilege, ensuring employees only have access to the resources they need for their specific role, minimizing the risk of an internal security breach.
2. **Secure Access to AWS Resources for Applications**: IAM roles can be used to grant applications running on EC2 instances permissions to access AWS resources without using static AWS access keys. This not only secures access to AWS services but also simplifies credential management, as roles automatically manage the credentials that the application uses.
3. **Delegation of Administration**: IAM enables the creation of IAM policies to delegate administrative tasks without granting full AWS account access. For instance, IT departments can delegate the management of specific AWS resources to the users who need to work with them, enhancing security and operational efficiency.
4. **Multi-Factor Authentication for Enhanced Security**: AWS IAM supports multi-factor authentication (MFA), adding an extra layer of security by requiring users to provide not just a password but also a piece of information only they possess. This significantly reduces the risk of unauthorized access resulting from compromised credentials.
5. **Cross-Account Access**: IAM roles enable users to securely access resources in another AWS account known as 'cross-account access'. This is particularly useful for companies that manage multiple AWS accounts and need a secure way of accessing resources across these accounts without having to create multiple user identities.

## How AWS Identity and Access Management (IAM) is priced

AWS IAM itself is offered at no additional charge to AWS customers, but costs may be incurred for optional features such as AWS Directory Service integration or when using external identities with AWS SSO.

- **Free Tier**: AWS Identity and Access Management (IAM) is available to AWS customers at no additional charge. This includes using the AWS Management Console, AWS Command Line Interface, AWS SDKs, and AWS APIs. IAM support for authenticating and authorizing their users is also included without extra cost. However, other AWS services accessed by these users may incur charges.
- **AWS Directory Service Integration**: For customers who integrate AWS IAM with AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD), additional costs are incurred for the AWS Directory Service. Pricing for the directory service is based on the edition chosen (Standard or Enterprise) and the region it is hosted in. This service is charged on an hourly rate, with prices varying by region.
- **AWS IAM Identity Center**: AWS IAM Identity Center integration with IAM is provided at no extra cost. However, if you use connected services such as AWS Directory Service, charges for those services may apply.
- **IAM Access Analyzer unused access analysis**: Unused access analysis is charged per IAM role or IAM user analyzed per month.
- **IAM Access Analyzer custom policy checks**: Custom policy checks are a paid IAM Access Analyzer feature.

## Services AWS Identity and Access Management (IAM) works with

- **[Amazon S3](https://blowstack.com/tools/cloud-services-hub/amazon-s3)**: IAM integrates with Amazon S3 to manage access to buckets and objects. Policies can be used to restrict who can read, write, or delete objects.
- **[Amazon EC2](https://blowstack.com/tools/cloud-services-hub/amazon-ec2)**: IAM allows you to create and manage permissions to control who can launch, terminate, and manage EC2 instances and their associated resources.
- **[AWS Lambda](https://blowstack.com/tools/cloud-services-hub/aws-lambda)**: IAM integrates with AWS Lambda to manage permissions for invoking functions and accessing other AWS resources from within Lambda functions.
- **[Amazon RDS](https://blowstack.com/tools/cloud-services-hub/amazon-rds)**: IAM manages access to Amazon RDS databases, allowing you to control who can create, modify, and delete databases, as well as manage database security groups.
- **[Amazon DynamoDB](https://blowstack.com/tools/cloud-services-hub/amazon-dynamodb)**: IAM controls access to Amazon DynamoDB tables and items, enabling fine-grained security permissions for accessing the database.
- **[Amazon API Gateway](https://blowstack.com/tools/cloud-services-hub/amazon-api-gateway)**: IAM policies control who can manage APIs and invoke methods configured for AWS_IAM authorization. Clients sign requests with AWS credentials, and API Gateway evaluates their permissions before accepting them.
- **[Amazon AppFlow](https://blowstack.com/tools/cloud-services-hub/amazon-appflow)**: IAM policies control access to AppFlow flows and connectors. IAM roles and resource policies authorize flows to read or write AWS destinations such as S3.
- **[Amazon Athena](https://blowstack.com/tools/cloud-services-hub/amazon-athena)**: IAM policies govern who can run Athena queries and use particular workgroups and data catalogs. Querying data also requires permissions for the underlying data and query-result locations.
- **[Amazon Augmented AI (Amazon A2I)](https://blowstack.com/tools/cloud-services-hub/amazon-augmented-ai-(amazon-a2i))**: IAM controls access to human review workflows and grants their execution roles permission to access input data and store review results. Administrators can also restrict who may create or start human loops.
- **[Amazon Aurora](https://blowstack.com/tools/cloud-services-hub/amazon-aurora)**: IAM policies govern Aurora cluster administration, and supported Aurora engines offer IAM database authentication. Applications can use short-lived authentication tokens instead of stored database passwords.
- **[Amazon Aurora Serverless](https://blowstack.com/tools/cloud-services-hub/amazon-aurora-serverless)**: IAM controls management of Aurora Serverless clusters and access through the RDS Data API on supported configurations. Data API callers need permissions to execute database operations and access the associated Secrets Manager secret.
- **[Amazon Bedrock](https://blowstack.com/tools/cloud-services-hub/amazon-bedrock)**: IAM policies determine which Bedrock models, agents, knowledge bases, and other resources a principal can use or manage. Bedrock service roles grant features such as knowledge bases permission to access their data sources and supporting resources.
- **[Amazon Bedrock AgentCore](https://blowstack.com/tools/cloud-services-hub/amazon-bedrock-agentcore)**: IAM controls access to AgentCore resources and authorizes supported runtime invocations. AgentCore runtime execution roles define which AWS resources a hosted agent can access.
- **[Amazon Braket](https://blowstack.com/tools/cloud-services-hub/amazon-braket)**: IAM policies determine who can submit quantum tasks, manage hybrid jobs, and access Braket resources. Hybrid jobs use execution roles to access resources such as input data and output locations.
- **[Amazon CloudFront](https://blowstack.com/tools/cloud-services-hub/amazon-cloudfront)**: IAM controls who can create or change CloudFront distributions and related resources. Administrators can restrict permissions to particular distributions or separate deployment permissions from read-only access.
- **[Amazon CloudSearch](https://blowstack.com/tools/cloud-services-hub/amazon-cloudsearch)**: IAM policies control CloudSearch domain administration and can authorize signed requests to document and search endpoints. Domain access policies can grant access to specified IAM principals.
- **[Amazon CloudWatch](https://blowstack.com/tools/cloud-services-hub/amazon-cloudwatch)**: IAM policies restrict access to CloudWatch metrics, alarms, dashboards, and logs. CloudWatch features also use IAM roles where they need permission to deliver data or perform configured actions.
- **[Amazon CodeGuru](https://blowstack.com/tools/cloud-services-hub/amazon-codeguru)**: IAM controls access to CodeGuru code reviews, repository associations, and profiling groups. Applications submitting profiling data can receive narrowly scoped permissions to publish to a particular profiling group.
- **[Amazon CodeWhisperer](https://blowstack.com/tools/cloud-services-hub/amazon-codewhisperer)**: IAM policies control administrative operations for CodeWhisperer profiles and customizations. These permissions are separate from the workforce sign-in used by developers receiving code suggestions.
- **[Amazon Cognito](https://blowstack.com/tools/cloud-services-hub/amazon-cognito)**: IAM roles define the AWS permissions granted to authenticated and guest users through Cognito identity pools. Role trust policies restrict which identities may obtain temporary credentials.
- **[Amazon Comprehend](https://blowstack.com/tools/cloud-services-hub/amazon-comprehend)**: IAM controls access to Comprehend analysis operations, custom models, and endpoints. Asynchronous jobs use IAM service roles to read input documents and write analysis results.
- **[Amazon Connect](https://blowstack.com/tools/cloud-services-hub/amazon-connect)**: IAM policies govern administration of Connect instances and access to Connect APIs. Connect also uses service-linked roles to access AWS resources needed for features such as logging and integrations.
- **[Amazon Data Firehose](https://blowstack.com/tools/cloud-services-hub/amazon-kinesis-data-firehose)**: IAM policies control delivery stream administration and who can submit records. Firehose assumes an IAM role to read supported sources, invoke transformations, and deliver records to configured destinations.
- **[Amazon DataZone](https://blowstack.com/tools/cloud-services-hub/amazon-datazone)**: IAM policies govern access to DataZone domains and management APIs. DataZone uses service and environment roles to provision environments and manage access to underlying data resources.
- **[Amazon Detective](https://blowstack.com/tools/cloud-services-hub/amazon-detective)**: IAM policies determine who can manage Detective behavior graphs and investigate their findings. Detective uses a service-linked role for supported integration operations.
- **[Amazon DevOps Guru](https://blowstack.com/tools/cloud-services-hub/amazon-devops-guru)**: IAM controls access to DevOps Guru insights and configuration. Its service-linked role allows it to analyze supported operational data and resource information.
- **[Amazon DocumentDB (with MongoDB compatibility)](https://blowstack.com/tools/cloud-services-hub/amazon-documentdb-(with-mongodb-compatibility))**: IAM policies control who can create, modify, or delete DocumentDB clusters and instances. Supported DocumentDB configurations also allow database authentication with IAM identities.
- **[Amazon EC2 Auto Scaling](https://blowstack.com/tools/cloud-services-hub/amazon-ec2-auto-scaling)**: IAM policies restrict management of Auto Scaling groups, scaling policies, and instance refreshes. Auto Scaling uses service-linked roles to launch and manage instances on behalf of a group.
- **[Amazon ECS Anywhere](https://blowstack.com/tools/cloud-services-hub/amazon-ecs-anywhere)**: IAM roles authorize external ECS instances to register with and communicate with ECS. Task roles provide separate AWS permissions to workloads running on those external instances.
- **[Amazon Elastic Block Store (Amazon EBS)](https://blowstack.com/tools/cloud-services-hub/amazon-elastic-block-store-(amazon-ebs))**: IAM policies control actions on EBS volumes and snapshots, including creation, attachment, deletion, and snapshot sharing. Tag-based conditions can restrict administrators to volumes belonging to a particular application.
- **[Amazon Elastic Container Registry (Amazon ECR)](https://blowstack.com/tools/cloud-services-hub/amazon-elastic-container-registry-(amazon-ecr))**: IAM policies and ECR repository policies determine who can push, pull, and manage container images. IAM permissions also control retrieval of the authorization tokens used by container clients.
- **[Amazon Elastic Container Service (Amazon ECS)](https://blowstack.com/tools/cloud-services-hub/amazon-elastic-container-service-(amazon-ecs))**: IAM task roles give each ECS task its own AWS permissions, while task execution roles authorize operations such as pulling images and sending logs. IAM also controls who can deploy services or pass roles to tasks.
- **[Amazon Elastic File System (Amazon EFS)](https://blowstack.com/tools/cloud-services-hub/amazon-elastic-file-system-(amazon-efs))**: IAM identity policies and EFS file system policies can authorize NFS clients using IAM authentication. Permissions distinguish mounting, writing, and root access, and can require a particular access point.
- **[Amazon Elastic Kubernetes Service (Amazon EKS)](https://blowstack.com/tools/cloud-services-hub/amazon-elastic-kubernetes-service-(amazon-eks))**: IAM principals can receive Kubernetes access through EKS access entries. EKS Pod Identity and IAM roles for service accounts give pods scoped AWS permissions without embedding long-term credentials.
- **[Amazon ElastiCache](https://blowstack.com/tools/cloud-services-hub/amazon-elasticache)**: IAM policies control ElastiCache administration, and supported Valkey and Redis OSS configurations offer IAM authentication for cache connections. Applications can authenticate with short-lived tokens tied to authorized IAM identities.
- **[Amazon EMR](https://blowstack.com/tools/cloud-services-hub/amazon-emr)**: IAM service roles and instance profiles authorize EMR to provision cluster resources and access workload data. EMR Serverless and EMR on EKS use execution roles to define the AWS permissions available to jobs.
- **[Amazon EventBridge](https://blowstack.com/tools/cloud-services-hub/amazon-eventbridge)**: IAM policies control event buses, rules, schedules, and event publication. EventBridge assumes configured execution roles for supported targets, and rules can match IAM API activity delivered through CloudTrail.
- **[Amazon Forecast](https://blowstack.com/tools/cloud-services-hub/amazon-forecast)**: IAM policies control access to Forecast datasets, predictors, and forecasts. Forecast assumes an IAM role to import training data and export forecast results.
- **[Amazon Fraud Detector](https://blowstack.com/tools/cloud-services-hub/amazon-fraud-detector)**: IAM policies govern Fraud Detector models, detectors, and prediction operations. Service roles authorize access to training datasets and supported external model resources.
- **[Amazon FSx](https://blowstack.com/tools/cloud-services-hub/amazon-fsx-(for-all-types))**: IAM policies control creation and management of FSx file systems, backups, and related resources. FSx uses service-linked roles to manage supporting AWS resources such as network interfaces.
- **[Amazon GameLift](https://blowstack.com/tools/cloud-services-hub/amazon-gamelift)**: IAM controls access to GameLift fleets, builds, aliases, and game-session management APIs. Fleet IAM roles can supply temporary AWS credentials to game server processes.
- **[Amazon GuardDuty](https://blowstack.com/tools/cloud-services-hub/amazon-guardduty)**: IAM policies govern GuardDuty detectors, findings, and protection settings. GuardDuty uses service-linked roles to access supported data sources and perform threat-detection operations.
- **[Amazon HealthLake](https://blowstack.com/tools/cloud-services-hub/amazon-healthlake)**: IAM policies control HealthLake data stores and access to their APIs. Import and export jobs use IAM roles to read and write data in S3.
- **[Amazon Inspector](https://blowstack.com/tools/cloud-services-hub/amazon-inspector)**: IAM policies determine who can enable Inspector scanning and access vulnerability findings. Inspector service-linked roles authorize discovery and scanning of supported AWS resources.
- **[Amazon Kendra](https://blowstack.com/tools/cloud-services-hub/amazon-kendra)**: IAM policies control access to Kendra indexes and search APIs. Kendra assumes service roles to crawl data sources, access documents, and write operational logs.
- **[Amazon Keyspaces (for Apache Cassandra)](https://blowstack.com/tools/cloud-services-hub/amazon-keyspaces-(for-apache-cassandra))**: IAM policies authorize Keyspaces operations at the keyspace and table level. Cassandra clients can use the SigV4 authentication plugin to connect with IAM credentials instead of service-specific credentials.
- **[Amazon Kinesis Data Streams](https://blowstack.com/tools/cloud-services-hub/amazon-kinesis-data-streams)**: IAM policies control stream administration and permissions to publish or consume records. Stream resource policies can grant access to IAM principals in another AWS account.
- **[Amazon Kinesis Video Streams](https://blowstack.com/tools/cloud-services-hub/amazon-kinesis-video-streams)**: IAM policies determine who can create video streams and publish or retrieve their media. Resource-scoped permissions can separate camera upload access from playback access.
- **[Amazon Lex](https://blowstack.com/tools/cloud-services-hub/amazon-lex)**: IAM policies control Lex bot administration and runtime conversations. Lex uses service-linked roles for supported operations and integrations.
- **[Amazon Lightsail](https://blowstack.com/tools/cloud-services-hub/amazon-lightsail)**: IAM policies control access to Lightsail instances, databases, snapshots, and other resources. Administrators can separate read-only visibility from permissions to create or delete resources.
- **[Amazon Location Service](https://blowstack.com/tools/cloud-services-hub/amazon-location-service)**: IAM policies authorize access to Location maps, trackers, geofence collections, and other resources. Applications can use temporary credentials to make signed requests within those permissions.
- **[Amazon Macie](https://blowstack.com/tools/cloud-services-hub/amazon-macie)**: IAM policies govern Macie configuration, classification jobs, and access to findings. Macie uses a service-linked role to inspect S3 resources and discover sensitive data.
- **[Amazon Managed Blockchain](https://blowstack.com/tools/cloud-services-hub/amazon-managed-blockchain)**: IAM policies control Managed Blockchain networks, members, nodes, and supported blockchain API access. Managed Blockchain Access endpoints use SigV4-signed requests to authenticate callers.
- **[Amazon Managed Grafana](https://blowstack.com/tools/cloud-services-hub/amazon-managed-grafana)**: IAM controls workspace administration and the AWS permissions available to Grafana data sources. Workspace roles can grant access to metrics and logs in the same account or across accounts.
- **[Amazon Managed Service for Apache Flink](https://blowstack.com/tools/cloud-services-hub/amazon-managed-service-for-apache-flink)**: IAM policies control Flink application administration. Applications run with service execution roles that authorize access to configured streams, storage, logs, and other AWS resources.
- **[Amazon Managed Service for Prometheus](https://blowstack.com/tools/cloud-services-hub/amazon-managed-service-for-prometheus)**: IAM policies control workspace management and access to metric ingestion and query APIs. Collectors and query clients use SigV4-signed requests with authorized IAM credentials.
- **[Amazon Managed Streaming for Apache Kafka](https://blowstack.com/tools/cloud-services-hub/amazon-managed-streaming-for-apache-kafka)**: IAM policies control MSK cluster administration and can authorize Kafka client connections when IAM access control is enabled. Policies can restrict clients to particular topics, consumer groups, and Kafka operations.
- **[Amazon Managed Workflows for Apache Airflow (Amazon MWAA)](https://blowstack.com/tools/cloud-services-hub/amazon-managed-workflows-for-apache-airflow-(amazon-mwaa))**: IAM controls MWAA environment management and access to Airflow interfaces. An environment execution role defines the AWS resources its workflows and supporting components can access.
- **[Amazon MemoryDB for Redis](https://blowstack.com/tools/cloud-services-hub/amazon-memorydb-for-redis)**: IAM policies control MemoryDB clusters, users, and access control lists. Supported engine versions also allow clients to authenticate with short-lived IAM authentication tokens.
- **[Amazon Monitron](https://blowstack.com/tools/cloud-services-hub/amazon-monitron)**: IAM policies govern administrative access to Monitron projects and associated resources. Monitron also uses a service-linked role for operations required by the service.
- **[Amazon MQ](https://blowstack.com/tools/cloud-services-hub/amazon-mq)**: IAM policies control broker creation, configuration, and other Amazon MQ management operations. These permissions are separate from the broker credentials used by messaging clients.
- **[Amazon Neptune](https://blowstack.com/tools/cloud-services-hub/amazon-neptune)**: IAM policies control Neptune administration and can authorize database requests when IAM database authentication is enabled. Clients sign requests with AWS credentials to access the graph.
- **[Amazon OpenSearch Service](https://blowstack.com/tools/cloud-services-hub/amazon-opensearch-service)**: IAM policies and domain access policies control OpenSearch Service administration and access to domain endpoints. With fine-grained access control, IAM roles can be mapped to OpenSearch roles for index-level permissions.
- **[Amazon Personalize](https://blowstack.com/tools/cloud-services-hub/amazon-personalize)**: IAM policies control Personalize datasets, training resources, and recommendation APIs. Personalize assumes service roles to import training data and access supporting AWS resources.
- **[Amazon Polly](https://blowstack.com/tools/cloud-services-hub/amazon-polly)**: IAM policies determine who can synthesize speech and manage pronunciation lexicons. Permissions can also restrict access to asynchronous speech-synthesis tasks.
- **[Amazon Q](https://blowstack.com/tools/cloud-services-hub/amazon-q)**: IAM policies control access to supported Amazon Q operations. For Amazon Q Developer, administrators can use IAM permissions to govern capabilities such as chat and inline suggestions.
- **[Amazon Q Business](https://blowstack.com/tools/cloud-services-hub/amazon-q-business)**: IAM policies control Q Business applications, indexes, retrievers, and other management resources. Service roles authorize document ingestion and access to configured data sources.
- **[Amazon QuickSight](https://blowstack.com/tools/cloud-services-hub/amazon-quicksight)**: IAM policies control QuickSight administration and API access, including embedding operations. QuickSight service roles authorize access to AWS data sources used by datasets.
- **[Amazon RDS Proxy](https://blowstack.com/tools/cloud-services-hub/amazon-rds-proxy)**: IAM policies can require applications to authenticate to RDS Proxy with IAM credentials. The proxy uses an IAM role to retrieve database credentials from Secrets Manager when configured for secret-based backend authentication.
- **[Amazon Redshift](https://blowstack.com/tools/cloud-services-hub/amazon-redshift)**: IAM roles authorize Redshift to load, unload, and query data in other AWS services. IAM identities can also obtain temporary database credentials or access Redshift through supported IAM authentication features.
- **[Amazon Rekognition](https://blowstack.com/tools/cloud-services-hub/amazon-rekognition)**: IAM policies control image and video analysis operations and access to Rekognition collections. Video analysis workflows use a service role to publish completion notifications to SNS.
- **[Amazon Route 53](https://blowstack.com/tools/cloud-services-hub/amazon-route-53)**: IAM policies govern hosted zones, health checks, and DNS record changes. Conditions can restrict record changes by record name, record type, and requested action.
- **[Amazon S3 Glacier](https://blowstack.com/tools/cloud-services-hub/amazon-s3-glacier)**: IAM policies and Glacier vault access policies control archive uploads, retrievals, and vault management. Administrators can grant a principal access to a specific vault without granting access to every archive repository.
- **[Amazon SageMaker](https://blowstack.com/tools/cloud-services-hub/amazon-sagemaker)**: IAM policies control SageMaker resources and who may pass execution roles to workloads. Execution roles define the data, container images, encryption keys, and other AWS resources available to training jobs and hosted models.
- **[Amazon SageMaker Data Wrangler](https://blowstack.com/tools/cloud-services-hub/amazon-sagemaker-data-wrangler)**: IAM execution-role permissions determine which data sources Data Wrangler can access and where it can export transformed data. IAM also controls the SageMaker resources used to run Data Wrangler processing jobs.
- **[Amazon SageMaker Ground Truth](https://blowstack.com/tools/cloud-services-hub/amazon-sagemaker-ground-truth)**: IAM policies control labeling jobs and workforce administration. Ground Truth uses execution roles to access input data and write labeling outputs.
- **[Amazon Security Lake](https://blowstack.com/tools/cloud-services-hub/amazon-security-lake)**: IAM policies govern Security Lake administration and subscriber management. Security Lake uses service-linked and other IAM roles to collect security data and manage supporting resources.
- **[Amazon Simple Email Service (Amazon SES)](https://blowstack.com/tools/cloud-services-hub/amazon-simple-email-service-(amazon-ses))**: IAM policies control email sending and SES administration. Sending permissions can be restricted by sender or recipient conditions, and SES SMTP credentials are derived from IAM access credentials.
- **[Amazon Simple Notification Service (Amazon SNS)](https://blowstack.com/tools/cloud-services-hub/amazon-simple-notification-service-(amazon-sns))**: IAM policies and SNS topic policies determine who can publish, subscribe, and administer topics. Topic policies can also authorize specific AWS services or cross-account IAM principals to publish.
- **[Amazon Simple Queue Service (Amazon SQS)](https://blowstack.com/tools/cloud-services-hub/amazon-simple-queue-service-(amazon-sqs))**: IAM policies and SQS queue policies control who can send, receive, delete, and manage messages. Queue policies can grant access to particular IAM principals or authorize message delivery from AWS services.
- **[Amazon Textract](https://blowstack.com/tools/cloud-services-hub/amazon-textract)**: IAM policies control Textract document-analysis operations. Asynchronous jobs can assume an IAM role to publish completion notifications to an SNS topic.
- **[Amazon Timestream](https://blowstack.com/tools/cloud-services-hub/amazon-timestream)**: IAM policies authorize Timestream database and table administration, record writes, and queries. Permissions can separate ingestion workloads from applications that only read time-series data.
- **[Amazon Timestream for InfluxDB](https://blowstack.com/tools/cloud-services-hub/amazon-timestream-for-influxdb)**: IAM policies control creation and management of Timestream for InfluxDB instances. These management permissions are separate from the InfluxDB tokens used to query and write database data.
- **[Amazon Transcribe](https://blowstack.com/tools/cloud-services-hub/amazon-transcribe)**: IAM policies control transcription jobs, streaming transcription, vocabularies, and language models. Supported transcription workflows use service roles to access input media and other required resources.
- **[Amazon Translate](https://blowstack.com/tools/cloud-services-hub/amazon-translate)**: IAM policies control translation operations and access to custom terminology and parallel data. Batch translation jobs assume an IAM role to read source documents and write translated output.
- **[Amazon Verified Permissions](https://blowstack.com/tools/cloud-services-hub/amazon-verified-permissions)**: IAM policies control access to Verified Permissions policy stores and authorization APIs. They determine which AWS callers may manage application policies or submit authorization requests, separately from the application permissions those policies evaluate.
- **[Amazon VPC](https://blowstack.com/tools/cloud-services-hub/amazon-vpc)**: IAM policies control creation and modification of VPCs, subnets, route tables, security groups, and other networking resources. Conditions can restrict network administration by resource tags and other supported attributes.
- **[Amazon WorkSpaces](https://blowstack.com/tools/cloud-services-hub/amazon-workspaces)**: IAM policies govern WorkSpaces provisioning and administration. WorkSpaces uses service roles to perform required operations on supporting AWS resources.
- **[Amazon WorkSpaces Applications](https://blowstack.com/tools/cloud-services-hub/amazon-appstream-2)**: IAM policies control fleets, stacks, images, and streaming URL creation. Fleet IAM roles can provide temporary AWS credentials to applications running in streaming instances.
- **[Amazon WorkSpaces Secure Browser](https://blowstack.com/tools/cloud-services-hub/amazon-workspaces-web)**: IAM policies govern Secure Browser portals, browser settings, network settings, and related administrative resources. These administrative permissions are separate from end-user authentication to a browsing session.
- **[AWS Amplify](https://blowstack.com/tools/cloud-services-hub/aws-amplify)**: IAM policies control Amplify applications, branches, and deployments. Amplify service roles authorize backend provisioning, and supported hosting compute roles provide AWS permissions to server-side application code.
- **[AWS App Runner](https://blowstack.com/tools/cloud-services-hub/aws-app-runner)**: IAM controls App Runner service management and role assignment. Access roles authorize private ECR image retrieval, while instance roles provide AWS permissions to running applications.
- **[AWS AppConfig](https://blowstack.com/tools/cloud-services-hub/aws-appconfig)**: IAM policies distinguish permission to manage AppConfig applications and deployments from permission to retrieve configuration data. AppConfig can assume retrieval roles to read configuration from supported external stores.
- **[AWS Application Discovery Service](https://blowstack.com/tools/cloud-services-hub/aws-application-discovery-service)**: IAM policies control access to discovered server information, discovery configurations, and export operations. Discovery agents use AWS credentials with permissions to submit collected inventory data.
- **[AWS Application Migration Service](https://blowstack.com/tools/cloud-services-hub/aws-application-migration-service)**: IAM policies govern migration source servers, replication settings, and launch actions. Application Migration Service uses service-linked and other IAM roles to manage replication and launch target instances.
- **[AWS AppSync](https://blowstack.com/tools/cloud-services-hub/aws-appsync)**: IAM policies authorize GraphQL requests when an AppSync API enables AWS_IAM authentication. AppSync also assumes data-source roles to access resources such as DynamoDB tables or Lambda functions.
- **[AWS Artifact](https://blowstack.com/tools/cloud-services-hub/aws-artifact)**: IAM policies control access to Artifact compliance reports and agreement operations. Administrators can separate report downloads from permissions to accept or terminate agreements.
- **[AWS Audit Manager](https://blowstack.com/tools/cloud-services-hub/aws-audit-manager)**: IAM policies control Audit Manager assessments, frameworks, and evidence access. Audit Manager uses a service-linked role to collect evidence from supported AWS services.
- **[AWS Auto Scaling](https://blowstack.com/tools/cloud-services-hub/aws-auto-scaling)**: IAM policies control scaling plans and supported application scaling configurations. Scaling services use service-linked roles to inspect and adjust the capacity of target resources.
- **[AWS Backup](https://blowstack.com/tools/cloud-services-hub/aws-backup)**: IAM policies govern backup plans, vaults, recovery points, and restore operations. AWS Backup assumes service roles to back up and restore protected resources.
- **[AWS Batch](https://blowstack.com/tools/cloud-services-hub/aws-batch)**: IAM policies control Batch queues, compute environments, job definitions, and job submission. Service roles manage compute resources, while job roles provide scoped AWS permissions to workloads.
- **[AWS Billing and Cost Management](https://blowstack.com/tools/cloud-services-hub/aws-billing-and-cost-management)**: IAM policies control access to billing information, payment settings, and cost-management operations after IAM access to billing is enabled where required. Administrators can grant financial visibility without granting permission to change payment details.
- **[AWS Billing Conductor](https://blowstack.com/tools/cloud-services-hub/aws-billing-conductor)**: IAM policies govern Billing Conductor billing groups, pricing plans, pricing rules, and custom line items. Financial administrators can receive pricing-management permissions without broader infrastructure access.
- **[AWS Budgets](https://blowstack.com/tools/cloud-services-hub/aws-budgets)**: IAM policies control budget creation and modification. Budget actions can use an IAM execution role to attach IAM policies or apply other configured enforcement actions when a threshold is reached.
- **[AWS Certificate Manager (ACM)](https://blowstack.com/tools/cloud-services-hub/aws-certificate-manager-(acm))**: IAM policies control certificate requests, imports, exports where supported, and deletion. Conditions can restrict certificate requests by domain name and other supported certificate attributes.
- **[AWS Chatbot](https://blowstack.com/tools/cloud-services-hub/aws-chatbot)**: IAM roles define the AWS permissions available to chat channels and individual users running commands through AWS Chatbot. Channel guardrail policies further limit those permissions.
- **[AWS Clean Rooms](https://blowstack.com/tools/cloud-services-hub/aws-clean-rooms)**: IAM policies control collaborations, memberships, configured tables, and analysis operations. Clean Rooms assumes configured IAM roles to access underlying data and write query results.
- **[AWS Client VPN](https://blowstack.com/tools/cloud-services-hub/aws-client-vpn)**: IAM policies govern Client VPN endpoints, network associations, routes, and authorization rules. Client VPN uses a service-linked role to manage supporting network resources.
- **[AWS Cloud Map](https://blowstack.com/tools/cloud-services-hub/aws-cloud-map)**: IAM policies control Cloud Map namespaces, services, instance registration, and discovery operations. Permissions can distinguish applications that register service instances from clients that only discover them.
- **[AWS Cloud9](https://blowstack.com/tools/cloud-services-hub/aws-cloud9)**: IAM policies control Cloud9 environment creation, access, and sharing. Cloud9 also supports managed temporary AWS credentials for supported EC2 development environments.
- **[AWS CloudFormation](https://blowstack.com/tools/cloud-services-hub/aws-cloudformation)**: CloudFormation templates can provision IAM users, groups, roles, managed policies, and identity providers. CloudFormation can also assume an IAM service role that defines its permissions to create and manage stack resources.
- **[AWS CloudHSM](https://blowstack.com/tools/cloud-services-hub/aws-cloudhsm)**: IAM policies control CloudHSM cluster and backup administration. IAM permissions do not replace the separate HSM user authentication used for cryptographic operations.
- **[AWS CloudShell](https://blowstack.com/tools/cloud-services-hub/aws-cloudshell)**: IAM policies control access to CloudShell and supported environment operations. CloudShell makes temporary credentials from the signed-in AWS session available to commands, so their AWS access remains bounded by that identity's permissions.
- **[AWS CloudTrail](https://blowstack.com/tools/cloud-services-hub/aws-cloudtrail)**: CloudTrail records IAM API activity, including changes to users, roles, policies, and access keys. These events provide an audit trail for investigating permission changes and credential use.
- **[AWS CodeArtifact](https://blowstack.com/tools/cloud-services-hub/aws-codeartifact)**: IAM policies and CodeArtifact resource policies control domains, repositories, and package operations. Authorized IAM principals obtain temporary authorization tokens for package-manager access.
- **[AWS CodeBuild](https://blowstack.com/tools/cloud-services-hub/aws-codebuild)**: IAM policies control build projects and build execution. Each project's service role defines the AWS resources its builds can access, such as source artifacts, logs, and deployment destinations.
- **[AWS CodeCommit](https://blowstack.com/tools/cloud-services-hub/aws-codecommit)**: IAM policies govern repository administration and Git access. Repository permissions can restrict operations on particular branches, while IAM users can use supported Git credentials or SSH public keys.
- **[AWS CodeConnections](https://blowstack.com/tools/cloud-services-hub/aws-codeconnections)**: IAM policies control connection creation, management, and use by services such as CodePipeline. PassConnection permissions govern which services may receive access to a connection.
- **[AWS CodeDeploy](https://blowstack.com/tools/cloud-services-hub/aws-codedeploy)**: IAM policies govern CodeDeploy applications, deployment groups, and deployment operations. CodeDeploy assumes a service role to interact with the compute and traffic-management resources involved in deployments.
- **[AWS CodePipeline](https://blowstack.com/tools/cloud-services-hub/aws-codepipeline)**: IAM policies control pipelines and their execution. Pipeline service roles and action roles authorize access to artifacts and the AWS resources used by each stage.
- **[AWS Compute Optimizer](https://blowstack.com/tools/cloud-services-hub/aws-compute-optimizer)**: IAM policies determine who can view Compute Optimizer recommendations and change enrollment or recommendation settings. Compute Optimizer uses a service-linked role to inspect supported resource configurations and metrics.
- **[AWS Config](https://blowstack.com/tools/cloud-services-hub/aws-config)**: Config records supported IAM resource configurations and evaluates rules for issues such as inactive credentials, missing MFA, and overly permissive policies. Its recorder uses an IAM role to discover resources and deliver configuration information.
- **[AWS Control Tower](https://blowstack.com/tools/cloud-services-hub/aws-control-tower)**: Control Tower uses IAM roles to establish and govern a landing zone and enrolled accounts. Its controls can also detect or prevent selected insecure IAM configurations.
- **[AWS Cost and Usage Report](https://blowstack.com/tools/cloud-services-hub/aws-cost-and-usage-report)**: IAM policies control creation, modification, and deletion of Cost and Usage Report definitions. Access to delivered report files is governed separately through permissions on the destination S3 bucket.
- **[AWS Cost Explorer](https://blowstack.com/tools/cloud-services-hub/aws-cost-explorer)**: IAM policies control access to Cost Explorer queries, forecasts, and related cost-management APIs. Administrators can grant cost-analysis permissions without granting access to provision or modify the resources generating those costs.
- **[AWS Data Exchange](https://blowstack.com/tools/cloud-services-hub/aws-data-exchange)**: IAM policies govern Data Exchange datasets, revisions, assets, jobs, and data grants. Permissions can separate provider publishing operations from subscriber access.
- **[AWS Data Pipeline](https://blowstack.com/tools/cloud-services-hub/aws-data-pipeline)**: IAM policies control pipeline definitions and execution management. Pipeline service roles and resource roles authorize orchestration and access to the data and compute resources used by activities.
- **[AWS Database Migration Service (AWS DMS)](https://blowstack.com/tools/cloud-services-hub/aws-database-migration-service-(aws-dms))**: IAM policies control DMS replication resources, endpoints, and migration tasks. DMS uses IAM roles for supported endpoints and operations such as accessing S3, writing logs, and managing network resources.
- **[AWS DataSync](https://blowstack.com/tools/cloud-services-hub/aws-datasync)**: IAM policies control DataSync agents, locations, tasks, and executions. DataSync assumes configured IAM roles to access supported storage locations such as S3 buckets.
- **[AWS DeepRacer](https://blowstack.com/tools/cloud-services-hub/aws-deepracer)**: IAM policies control DeepRacer model training, evaluation, and related service operations. DeepRacer uses service roles to access resources required by its managed training workflows.
- **[AWS Device Farm](https://blowstack.com/tools/cloud-services-hub/aws-device-farm)**: IAM policies control Device Farm projects, test runs, device pools, and remote-access sessions. Permissions can limit users to particular testing projects.
- **[AWS DevOps Agent](https://blowstack.com/tools/cloud-services-hub/aws-devops-agent)**: IAM policies govern access to DevOps Agent resources. Configured IAM roles define which AWS resources the agent may inspect during operational investigations.
- **[AWS Direct Connect](https://blowstack.com/tools/cloud-services-hub/aws-direct-connect)**: IAM policies control Direct Connect connections, virtual interfaces, gateways, and association operations. Administrators can separate network visibility from permissions to change connectivity.
- **[AWS Directory Service](https://blowstack.com/tools/cloud-services-hub/aws-directory-service)**: IAM policies control directory creation, management, and supported directory integrations. Directory Service uses service-linked roles to manage supporting AWS resources.
- **[AWS Elastic Beanstalk](https://blowstack.com/tools/cloud-services-hub/aws-elastic-beanstalk)**: IAM policies control Beanstalk applications, environments, and deployments. Environment service roles and EC2 instance profiles authorize health monitoring, resource management, and application access to AWS services.
- **[AWS Elastic Disaster Recovery](https://blowstack.com/tools/cloud-services-hub/aws-elastic-disaster-recovery)**: IAM policies govern source servers, replication settings, recovery launches, and failback operations. Elastic Disaster Recovery uses IAM roles to manage replication infrastructure and recovery resources.
- **[AWS Entity Resolution](https://blowstack.com/tools/cloud-services-hub/aws-entity-resolution)**: IAM policies control Entity Resolution schemas, matching workflows, and related resources. Workflow execution roles authorize reading input datasets and writing matching results.
- **[AWS Fargate](https://blowstack.com/tools/cloud-services-hub/aws-fargate)**: IAM roles provide credentials to ECS tasks and EKS pods running on Fargate. ECS task execution roles and EKS pod execution roles authorize platform operations such as pulling container images.
- **[AWS Fault Injection Service](https://blowstack.com/tools/cloud-services-hub/aws-fault-injection-simulator-(aws-fis))**: IAM policies control experiment templates and experiment execution. Each experiment uses an IAM role whose permissions define which resources and fault-injection actions the experiment can affect.
- **[AWS Firewall Manager](https://blowstack.com/tools/cloud-services-hub/aws-firewall-manager)**: IAM policies control Firewall Manager security policies and administrative operations. Firewall Manager uses service-linked roles to manage supported security protections across organization accounts.
- **[AWS Global Accelerator](https://blowstack.com/tools/cloud-services-hub/aws-global-accelerator)**: IAM policies govern accelerators, listeners, endpoint groups, and traffic configuration. Global Accelerator uses service-linked roles for supported operations on underlying AWS resources.
- **[AWS Glue](https://blowstack.com/tools/cloud-services-hub/aws-glue)**: IAM policies control Glue jobs, crawlers, connections, and Data Catalog resources. Glue assumes service roles to discover data, execute transformations, and access input and output locations.
- **[AWS Glue DataBrew](https://blowstack.com/tools/cloud-services-hub/aws-glue-databrew)**: IAM policies govern DataBrew projects, datasets, recipes, and jobs. DataBrew assumes a configured role to read source data and write prepared datasets and job output.
- **[AWS Health Dashboard](https://blowstack.com/tools/cloud-services-hub/aws-health-dashboard)**: IAM policies control access to AWS Health account-specific events and affected-resource details. Administrators can grant operational teams access to service-health information without granting infrastructure modification permissions.
- **[AWS IAM Identity Center (AWS Single Sign-On)](https://blowstack.com/tools/cloud-services-hub/aws-iam-identity-center-(aws-single-sign-on))**: Identity Center permission sets provision and maintain IAM roles in assigned AWS accounts. Users receive temporary credentials for those roles, with permissions defined by the permission set.
- **[AWS IoT Core](https://blowstack.com/tools/cloud-services-hub/aws-iot-core)**: IAM policies authorize IoT Core management APIs and supported data-plane requests made with AWS credentials. The credentials provider exchanges device certificate authentication for temporary credentials from a configured IAM role.
- **[AWS IoT Device Defender](https://blowstack.com/tools/cloud-services-hub/aws-iot-device-defender)**: IAM policies control audit configurations, security profiles, findings, and mitigation tasks. Device Defender uses IAM roles to perform audits and carry out configured mitigation actions.
- **[AWS IoT Device Management](https://blowstack.com/tools/cloud-services-hub/aws-iot-device-management)**: IAM policies govern device registries, fleet indexing, jobs, and secure-tunneling management APIs. Supported fleet operations use IAM roles to access job documents and other required resources.
- **[AWS IoT Greengrass](https://blowstack.com/tools/cloud-services-hub/aws-iot-greengrass)**: IAM policies control Greengrass components, deployments, and core-device resources. A token exchange role supplies temporary AWS credentials to components running on a core device.
- **[AWS IoT SiteWise](https://blowstack.com/tools/cloud-services-hub/aws-iot-sitewise)**: IAM policies control SiteWise asset models, assets, measurements, and portal administration. SiteWise uses configured roles for features that access other AWS resources.
- **[AWS Key Management Service (AWS KMS)](https://blowstack.com/tools/cloud-services-hub/aws-key-management-service-(aws-kms))**: IAM policies work with KMS key policies and grants to authorize encryption, decryption, and key administration. Key policies determine whether and how an account can delegate access through IAM policies.
- **[AWS Lake Formation](https://blowstack.com/tools/cloud-services-hub/aws-lake-formation)**: Lake Formation grants data permissions to IAM users and roles, while IAM controls access to its administrative APIs. Registered data locations use IAM roles that allow Lake Formation to provide governed access to underlying S3 data.
- **[AWS Launch Wizard](https://blowstack.com/tools/cloud-services-hub/aws-launch-wizard)**: IAM policies control Launch Wizard deployments and administrative operations. Deployment roles authorize Launch Wizard to provision and configure resources required by supported applications.
- **[AWS License Manager](https://blowstack.com/tools/cloud-services-hub/aws-license-manager)**: IAM policies govern license configurations, grants, and usage-management operations. License Manager uses service-linked roles to discover and manage supported license-related resources.
- **[AWS Managed Services (AMS)](https://blowstack.com/tools/cloud-services-hub/aws-managed-services-(ams))**: IAM roles provide the controlled cross-account access AMS uses to operate managed AWS environments. IAM policies define the resources and operational actions available to those roles.
- **[AWS Marketplace](https://blowstack.com/tools/cloud-services-hub/aws-marketplace)**: IAM policies control Marketplace subscription, procurement, and seller operations. Administrators can restrict who may subscribe to products or manage a private marketplace.
- **[AWS Migration Hub](https://blowstack.com/tools/cloud-services-hub/aws-migration-hub)**: IAM policies control access to migration tracking, application groupings, and related Migration Hub operations. Migration tools receive permissions to report resource and migration-task progress.
- **[AWS Network Firewall](https://blowstack.com/tools/cloud-services-hub/aws-network-firewall)**: IAM policies control firewalls, firewall policies, rule groups, and logging configurations. Permissions can separate rule maintenance from the ability to change firewall deployments.
- **[AWS Organizations](https://blowstack.com/tools/cloud-services-hub/aws-organizations)**: Organizations service control policies limit the permissions available to IAM principals in member accounts without granting permissions themselves. Organizations can also centrally manage root access and other supported identity controls across accounts.
- **[AWS Outposts](https://blowstack.com/tools/cloud-services-hub/aws-outposts)**: IAM policies govern Outposts sites, orders, capacity information, and other management resources. Workloads on Outposts use the IAM integrations of their underlying AWS services, including instance profiles for EC2.
- **[AWS Private Certificate Authority](https://blowstack.com/tools/cloud-services-hub/aws-private-certificate-authority)**: IAM policies control private CA administration and certificate issuance. Resource policies can authorize certificate operations for designated principals, including principals in other accounts.
- **[AWS PrivateLink](https://blowstack.com/tools/cloud-services-hub/aws-privatelink)**: IAM policies control VPC endpoint and endpoint-service management. Endpoint policies on supported services can further restrict which IAM principals and operations may use an endpoint.
- **[AWS Resilience Hub](https://blowstack.com/tools/cloud-services-hub/aws-resilience-hub)**: IAM policies control Resilience Hub applications, resilience policies, and assessments. Resilience Hub uses configured IAM roles to discover application resources and assess their resilience.
- **[AWS Resource Access Manager (AWS RAM)](https://blowstack.com/tools/cloud-services-hub/aws-resource-access-manager-(aws-ram))**: IAM policies govern resource shares, invitations, and sharing operations. RAM can share supported resources with designated IAM roles or users where the resource type supports that principal type.
- **[AWS Resource Groups and Tag Editor](https://blowstack.com/tools/cloud-services-hub/aws-resource-groups-and-tag-editor)**: IAM policies control resource-group creation, membership queries, and tagging operations. Tag-based IAM conditions can then use supported resource tags to restrict access to AWS resources.
- **[AWS Secrets Manager](https://blowstack.com/tools/cloud-services-hub/aws-secrets-manager)**: IAM policies and secret resource policies control who can retrieve, update, rotate, or delete secrets. Permissions can restrict an application role to only the secrets it needs.
- **[AWS Security Hub](https://blowstack.com/tools/cloud-services-hub/aws-security-hub)**: IAM policies control Security Hub configuration, findings, insights, and automation rules. Security Hub uses a service-linked role for supported security checks and integration operations.
- **[AWS Security Token Service (AWS STS)](https://blowstack.com/tools/cloud-services-hub/aws-security-token-service-(aws-sts))**: STS issues temporary credentials for IAM roles and federated sessions. IAM role trust policies determine who may assume a role, while role policies and session policies bound the resulting permissions.
- **[AWS Serverless Application Repository](https://blowstack.com/tools/cloud-services-hub/aws-serverless-application-repository)**: IAM policies control application publication and access to Serverless Application Repository APIs. Deploying an application that creates IAM resources requires explicit acknowledgment of the relevant IAM capabilities.
- **[AWS Service Catalog](https://blowstack.com/tools/cloud-services-hub/aws-service-catalog)**: IAM policies control Service Catalog administration and product provisioning. Launch constraints specify IAM roles that Service Catalog assumes to provision products without giving end users direct permissions to every underlying resource.
- **[AWS Shield](https://blowstack.com/tools/cloud-services-hub/aws-shield)**: IAM policies control Shield Advanced subscriptions, protected resources, and response settings. Supported Shield features use IAM roles to inspect and manage associated protections.
- **[AWS Signer](https://blowstack.com/tools/cloud-services-hub/aws-signer)**: IAM policies control signing profiles, signing jobs, and signature revocation. Signing-profile resource permissions can authorize other AWS accounts to perform supported signing operations.
- **[AWS Site-to-Site VPN](https://blowstack.com/tools/cloud-services-hub/aws-site-to-site-vpn)**: IAM policies control customer gateways, VPN gateways, VPN connections, and tunnel settings. Administrators can grant network operators permission to inspect tunnels without allowing them to modify connectivity.
- **[AWS Snow Family](https://blowstack.com/tools/cloud-services-hub/aws-snow-family)**: IAM policies control Snow device jobs and supported device-management operations. Snow import and export jobs use IAM roles to access designated S3 resources.
- **[AWS Step Functions](https://blowstack.com/tools/cloud-services-hub/aws-step-functions)**: IAM policies control state machines and execution operations. Each state machine's execution role authorizes the AWS service actions its workflow can perform.
- **[AWS Storage Gateway](https://blowstack.com/tools/cloud-services-hub/aws-storage-gateway)**: IAM policies govern gateways, volumes, file shares, and tape operations. S3 File Gateway assumes IAM roles to access the buckets backing its file shares.
- **[AWS Systems Manager](https://blowstack.com/tools/cloud-services-hub/aws-systems-manager)**: IAM policies control Systems Manager sessions, commands, automation, parameters, and managed-node operations. Managed nodes use IAM roles for service communication, and automation runbooks can assume roles that define their execution permissions.
- **[AWS Transfer Family](https://blowstack.com/tools/cloud-services-hub/aws-transfer-family)**: IAM roles define the S3 or EFS access available to Transfer Family users. Optional session policies further restrict a user's access, such as limiting transfers to a particular S3 prefix.
- **[AWS Transit Gateway](https://blowstack.com/tools/cloud-services-hub/aws-transit-gateway)**: IAM policies govern transit gateways, attachments, routing tables, and route changes. Supported resource-level permissions and tag conditions can limit which networking resources an administrator may manage.
- **[AWS Trusted Advisor](https://blowstack.com/tools/cloud-services-hub/aws-trusted-advisor)**: Trusted Advisor checks IAM-related security settings, including supported checks for root-account MFA and credential practices. IAM policies separately control access to Trusted Advisor recommendations and management operations.
- **[AWS User Notifications](https://blowstack.com/tools/cloud-services-hub/aws-user-notifications)**: IAM policies control notification configurations, event rules, and delivery-channel associations. Administrators can restrict who may create or modify notifications for AWS events.
- **[AWS Verified Access](https://blowstack.com/tools/cloud-services-hub/aws-verified-access)**: IAM policies control Verified Access instances, groups, endpoints, and trust-provider configurations. These permissions govern administration rather than replacing the identity and device policies used to authorize application access.
- **[AWS WAF](https://blowstack.com/tools/cloud-services-hub/aws-waf)**: IAM policies control web ACLs, rule groups, IP sets, and associations with protected resources. Permissions can separate rule inspection from the ability to change traffic-filtering behavior.
- **[AWS Well-Architected Tool](https://blowstack.com/tools/cloud-services-hub/aws-well-architected-tool)**: IAM policies control workloads, reviews, lenses, and related Well-Architected Tool resources. Administrators can grant review access without allowing users to modify or delete workloads.
- **[AWS X-Ray](https://blowstack.com/tools/cloud-services-hub/aws-x-ray)**: IAM policies control trace submission, trace retrieval, sampling rules, and other X-Ray operations. Workload roles can receive write-only tracing permissions while investigation roles receive access to read traces.
- **[EC2 Image Builder](https://blowstack.com/tools/cloud-services-hub/ec2-image-builder)**: IAM policies govern image pipelines, recipes, components, and image distribution settings. Image Builder service-linked roles and instance profiles authorize infrastructure management and operations performed during image builds.
- **[Elastic Load Balancing (ELB)](https://blowstack.com/tools/cloud-services-hub/elastic-load-balancing-(elb))**: IAM policies control load balancers, listeners, target groups, and routing configuration. Elastic Load Balancing uses service-linked roles to manage supporting resources such as network interfaces.
- **[Red Hat OpenShift Service on AWS (ROSA)](https://blowstack.com/tools/cloud-services-hub/red-hat-openshift-service-on-aws-(rosa))**: ROSA uses IAM roles and STS temporary credentials to install and operate supported clusters. Operator roles provide individual OpenShift components with scoped permissions to manage AWS resources.
- **[VMware Cloud on AWS](https://blowstack.com/tools/cloud-services-hub/vmware-cloud-on-aws)**: A connected AWS account supplies a cross-account IAM role that VMware Cloud on AWS uses to provision and manage supporting resources such as network interfaces. This role does not replace VMware's separate user authentication and SDDC permissions.

## What is AWS Identity and Access Management (IAM)

AWS Identity and Access Management (IAM) is a pivotal feature within the Amazon Web Services (AWS) ecosystem, designed to provide secure and granular control over AWS resources. IAM facilitates the management of users, groups, permissions, and roles within an AWS environment, ensuring that only authenticated and authorized entities can access specific resources. This comprehensive security management tool is crucial for businesses and organizations to safeguard their cloud-based assets and data effectively.

At its core, AWS IAM allows for the creation and management of AWS users and groups, and the assignment of permissions that control which AWS resources users and groups can access. IAM policies, which are essentially documents that explicitly list permissions, define what actions are allowed or denied on different resources, enabling administrators to enforce security policies at a granular level. These policies are attached to IAM entities including users, groups, or roles. The flexibility of IAM enables complex configurations, such as allowing a user full access to Amazon S3 but restricting access to Amazon DynamoDB.

The AWS account root user starts with complete access to all AWS services and resources. Do not use the root user for everyday tasks; use other identities with the permissions needed for their tasks.

IAM groups are collections of IAM users. A policy attached to a group affects every user who belongs to that group.

Permission policies can also be attached to resources, rather than only to identities.

One of the key features of IAM is the role-based access control (RBAC) that enables the delegation of permissions for the purpose of carrying out specific tasks. This is particularly useful in scenarios where temporary access is needed without having to share security credentials. IAM roles can be assumed by AWS services, applications, or even users from a different AWS account, enhancing the collaboration across AWS accounts without compromising the security of resources.

IAM Identity Center provides workforce access across multiple AWS accounts and application assignments across AWS.

Furthermore, IAM seamlessly integrates with other AWS services ensuring that security and access policies are consistently applied across the AWS environment. This integrated approach allows for the central management of access permissions and auditing of AWS resources, making it easier for organizations to comply with regulatory requirements. Another significant advantage of IAM is its support for multi-factor authentication (MFA), adding an extra layer of security for accessing AWS services. With MFA, users must provide not only their usual authentication credentials but also an additional authentication factor, such as a FIDO2 passkey or security key, or a code from a virtual authenticator app or hardware TOTP token, to gain access. This feature greatly enhances the security of AWS accounts. AWS CloudTrail provides detailed access logs that track user activities within AWS, offering valuable insights for security audits. These logs can be analyzed to detect unusual behavior patterns or potential security breaches, allowing organizations to respond promptly to security incidents.

Despite its comprehensive features, AWS IAM is offered at no additional charge, making it an accessible tool for businesses of all sizes seeking to manage access to their AWS resources securely. However, while IAM itself is free, some actions performed using IAM, such as accessing other AWS services, may incur charges according to AWS's pricing policies.

IAM Access Analyzer unused access analysis continuously identifies unused access and centralizes findings in a dashboard, including unused roles, user access keys and passwords, and unused services and actions for active roles and users.

IAM Access Analyzer custom policy checks validate before deployment that IAM policies adhere to specified security standards, using automated reasoning to detect nonconformant policy updates.

In summary, AWS Identity and Access Management (IAM) is an essential component of the AWS cloud platform, providing the means to securely control access to AWS services and resources. With its powerful and flexible permission and policy management capabilities, IAM plays a critical role in protecting an organization's cloud infrastructure from unauthorized access, thereby maintaining the integrity and confidentiality of sensitive data and assets.

## Free AWS Identity and Access Management (IAM) tools

- [AWS Access Key ID Decoder](https://blowstack.com/tools/aws-access-key-id-decoder): Decode an access key ID to its account and key type, and fix credential errors.
- [AWS IAM Permissions Finder](https://blowstack.com/tools/aws-iam-permissions-finder): Find the actions a CLI command or SDK call needs, get the policy, and read AccessDenied errors.
- [AWS Credentials Chain Troubleshooter](https://blowstack.com/tools/aws-credentials-chain-troubleshooter): See which credentials the AWS CLI or an SDK uses for a profile in your ~/.aws/config, and what breaks it.
- [AWS IAM Access Denied Decoder](https://blowstack.com/tools/aws-iam-access-denied-decoder): Paste an access denied error: see which policy type denied which action, explicitly or implicitly, and what to check.