Apa iku AWS IAM?

Question

Apa iku AWS IAM?

Accepted Answer

**IAM** (Identity and Access Management) ngontrol **sapa bisa nindakake apa** ing AWS — ngrumasuhi users, groups, roles, lan permissions. Iki dadi fondasi keamanan AWS: saben aksi diotorisasi liwat IAM, dadi nggawé ngerti bab iki iku perlu banget.

## Apa sing dikontrol IAM

```text
IAM controls AUTHENTICATION (who you are) and AUTHORIZATION (what you can do):
  USERS    → individual identities (people or applications) with credentials
  GROUPS   → collections of users (assign permissions to a group → all its users get them)
  ROLES    → identities ASSUMED temporarily (by users, services, or AWS resources)
             — no permanent credentials; key for services/cross-account access
  POLICIES → JSON documents defining PERMISSIONS (what actions on what resources)
```

## Policies — nggawe permissions

```json
{
  "Effect": "Allow",
  "Action": ["s3:GetObject", "s3:PutObject"],
  "Resource": "arn:aws:s3:::my-bucket/*"
}
// → allows getting/putting objects in my-bucket (and nothing else)
```

Policies (JSON) nerangake **aksi apa** sing diidini/ditolak ing **resources apa** — dikonekne karo users, groups, utawa roles kanggo maringi permissions.

## Roles — credentials sementara (sanget penting)

```text
ROLES grant temporary permissions without long-lived credentials:
  → an EC2 instance assumes a role → its app accesses S3 (no embedded keys!)
  → a Lambda function assumes a role for its permissions
  → cross-account access; federated/SSO access
→ Roles avoid hardcoding credentials — a security best practice.
```

## Best practices

```text
✓ LEAST PRIVILEGE — grant only the permissions actually needed (not broad/admin)
✓ Use ROLES for applications/services (not embedded access keys)
✓ Enable MFA; protect the root account (don't use it for daily work)
✓ Use groups for permission management; rotate credentials; audit access
```

## Kenapa iki penting

Nggawé ngerti IAM iku perlu banget amarga iki dadi fondasi keamanan AWS — saben aksi ing AWS diotorisasi liwat IAM, dadi iki dadi pengetahuan sing perlu lan kudu dipahami kanggo makaryo karo AWS kanthi aman.

IAM ngontrol **sapa bisa nindakake apa** liwat komponen utamane: **users** (identitas sing duwe credentials), **groups** (kanggo ngrumasuhi permissions kanthi bareng-bareng), **roles** (identitas sing asumsi sementara), lan **policies** (dokumen JSON sing nerangake permissions).

Nggawé ngerti **policies** (nerangake aksi apa sing diidini ing resources apa) iku perlu kanggo maringi lan ngerti permissions kanthi bener.

Nggawé ngerti **roles** iku penting banget: iki maringi **credentials sementara tanpa long-lived keys**, ngidupake EC2 instances, Lambda functions, lan layanan liyane kanggo akses AWS resources kanthi aman **tanpa embed access keys** — best practice keamanan kritis sing ngilangi risiko serius saka credentials sing dikode langsung.

Nggawé ngerti **best practices** — utamane **least privilege** (maringi mung permissions sing bener-bener dibutuhi, ora akses admin sing luwes, mbatesi blast radius saka kompromiso apa wae), nggunakke roles kanggo aplikasi, ngidupake MFA, lan nglindungi root account — iki perlu banget kanggo keamanan AWS, amarga salah konfigurasi IAM (permissions sing katerlaluan, credentials sing bocor) iku sumber umum saka insiden keamanan.

Sebab IAM dadi penjaga kanggo saben akses AWS lan nggawe iku bener-bener penting kanggo keamanan (dene nggawe salah nyebabake pelanggaran serius), lan sebab nggawé ngerti users, roles, policies, lan best practices kaya least privilege iku perlu kanggo makaryo karo AWS kanthi aman, nggawé ngerti IAM iku pengetahuan AWS sing perlu, dadi fondasi — topik keamanan kritis sing kudu dipahami saben pengguna AWS, pusat saka makaryo karo AWS kanthi aman lan ngilangi kesalahan kontrol akses sing nyebabake insiden keamanan sing nyata.