AWS IAM Explained: Users, Groups, Roles and Policies

Understand AWS IAM users, groups, roles and policies by tracing a course publisher's denied object read through its actual caller, action and resource. Replace a personal application key with a workload role, correct an object-resource mismatch, and verify required access without granting administrator permissions. Chapters 00:00 Signing in did not authorize the object read 00:52 Follow the request that actually reached AWS 01:48 An IAM user is an identity, not every employee's default 02:46 A group manages permissions for IAM users 03:38 A role connects trusted use to temporary permissions 04:34 Replace the embedded key with the workload role 05:31 Read a policy statement as a scoped permission 06:25 A bucket and its objects are different resources 07:21 Correct the resource mismatch, then test the boundary 08:18 An allow is part of an evaluation, not the whole story 09:16 Least privilege needs evidence and maintenance 10:11 Choose the identity, scope the action, verify the result Official AWS references AWS documentation: https://docs.aws.amazon.com/IAM/lates... AWS documentation: https://docs.aws.amazon.com/IAM/lates... AWS documentation: https://docs.aws.amazon.com/IAM/lates... AWS documentation: https://docs.aws.amazon.com/IAM/lates... AWS documentation: https://docs.aws.amazon.com/IAM/lates... AWS documentation: https://docs.aws.amazon.com/AmazonS3/... #AWS #CloudArchitecture