AWS Identity and Access Management (IAM) controls who or what can access your AWS resources and what actions they can take. For a new account, the practical starting point is to protect the root user with multifactor authentication (MFA), use roles or IAM Identity Center for routine access, and grant only the permissions each person or workload needs.
What is AWS IAM?
IAM is the AWS service for controlling access to AWS resources. A request has three basic parts:
- Identity or principal: the person, application, or service making the request.
- Policy: the permissions that describe which actions are allowed or denied.
- Resource: the AWS object the request targets, such as a storage bucket or compute instance.
Authentication establishes which identity is signing in. Authorization determines whether that identity may perform a particular action on a particular resource. Having an IAM identity does not automatically grant permission to use AWS services. AWS explains the IAM model in its IAM introduction.
Which AWS identity should you use?
AWS offers several identity types. The right choice depends on whether access is for a person or a workload, whether credentials need to be temporary, and whether access should be centrally managed or shared across accounts.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
| Identity | Typical use | Credential pattern | What to know |
|---|---|---|---|
| Account root user | Rare account-level tasks | Root sign-in credentials | Created with the AWS account and has complete access. Do not use it for everyday administration. |
| IAM user | Specific cases that require a separately managed IAM identity | Can have long-term console credentials or access keys | Not the default choice for each person. Long-term credentials require careful protection and review. |
| IAM role | Workloads, delegated access, and cross-account access | Temporary credentials after the role is assumed | A role is an assumable identity, not a person-specific login. Its trust policy controls who or what may assume it. |
| IAM Identity Center workforce identity | People who need managed access to AWS accounts and applications | Workforce sign-in followed by role-based access | Centralizes workforce access; users receive access through assigned permissions and roles rather than needing a separate IAM user in each account. |
AWS recommends temporary credentials for both human users and workloads. For workforce access, IAM Identity Center provides centralized sign-in and role-based access; roles are also AWS’s primary method for cross-account access. For applications running on AWS, use an appropriate role rather than embedding long-term access keys in code. See AWS’s comparison of IAM identities and credentials.
Should you use the AWS root user?
Use the root user only when a task specifically requires it. It is created when you open the AWS account and has complete access, so routine console work should use a separate, appropriately authorized identity. AWS strongly recommends avoiding root for everyday tasks.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
- Turn on MFA for root. AWS recommends phishing-resistant options such as passkeys and security keys where possible. If you choose a physical security key for MFA, confirm that it is compatible with your sign-in setup.
- Keep root credentials protected and do not create root access keys for routine programmatic work.
- Use IAM Identity Center or an appropriate role-based approach for human access, and grant each person only the access their work requires.
These are part of AWS’s IAM security best practices.
How do IAM policies work?
Most IAM policies are JSON documents that describe whether requests are allowed or denied. A policy can specify actions, resources, and conditions. For example, a policy can allow a particular set of actions on a particular resource only under specified conditions. Avoid broad permissions as a permanent default: start with the access a task needs, then refine permissions as actual requirements become clear.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
| Policy type | Where it applies | Question it answers |
|---|---|---|
| Identity-based policy | Attached to an IAM user, group, or role | What actions may this identity perform, and on which resources? |
| Resource-based policy | Attached to a resource that supports such policies | Which principals may access this resource, and what may they do? |
| Role trust policy | Attached to a role | Who or what may assume this role? |
A role also needs permissions describing what it can do after it is assumed. Its trust policy and permissions policy serve different purposes: the first governs assumption; the second governs actions. AWS’s policies and permissions guide covers these policy types.
Why an Allow may not be enough
Effective access can depend on more than one applicable policy. Other controls can limit permissions, and an explicit Deny overrides an applicable Allow. In larger or more advanced setups, permissions boundaries, organization service control policies (SCPs), resource control policies (RCPs), and session policies may also affect access. Treat this as a reason to check all relevant controls when a request is denied, rather than assuming that adding another Allow will resolve it.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
A safe starting setup for a new AWS account
- Secure root: sign in as root to complete account tasks that require it, enable MFA, and avoid using root for routine work.
- Set up human access: use IAM Identity Center for centralized workforce access where appropriate, or another role-based method suited to your account. Assign only the access each person needs.
- Use roles for workloads: configure applications and AWS services to obtain temporary role credentials instead of placing long-term access keys in source code.
- Grant narrow permissions: specify the necessary actions and resources, and add conditions where they meaningfully restrict access. Do not treat administrator-wide or wildcard access as a safe permanent default.
- Turn on and maintain safeguards: use MFA, review credentials and permissions periodically, and remove those that are no longer needed. AWS recommends phishing-resistant MFA, including passkeys or security keys where possible.
- Review access with Access Analyzer: use it to identify external access and help generate policies from activity. For regional external-access coverage, enable an analyzer in each Region where supported resources are used. Unused-access analysis and customer policy checks may incur charges.
- Verify changes: IAM changes can take time to propagate. Check that a change has taken effect before relying on it in a production workflow.
AWS provides IAM Access Analyzer documentation for its findings and analysis capabilities.
Does AWS IAM cost money?
AWS offers IAM, IAM Identity Center, and the Security Token Service (STS) at no additional charge. That does not make every related capability free: external-access analysis in IAM Access Analyzer is free, while unused-access analysis and customer policy checks can incur charges. Services and resources accessed through IAM may have their own charges. Check the AWS IAM cost information and relevant service pricing for your use case.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Learn more about IAM
If you want guided practice, AWS links to an IAM introduction and tutorials from its Getting started with IAM page.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
