iam

1# AWS IAM
2 
3AWS Identity and Access Management (IAM) enables secure access control to AWS services and resources. IAM is foundational to AWS security—every AWS API call is authenticated and authorized through IAM.
4 
5## Table of Contents
6 
7- [Core Concepts](#core-concepts)
8- [Common Patterns](#common-patterns)
9- [CLI Reference](#cli-reference)
10- [Best Practices](#best-practices)
11- [Troubleshooting](#troubleshooting)
12- [References](#references)
13 
14## Core Concepts
15 
16### Principals
17 
18Entities that can make requests to AWS: IAM users, roles, federated users, and applications.
19 
20### Policies
21 
22JSON documents defining permissions. Types:
23- **Identity-based**: Attached to users, groups, or roles
24- **Resource-based**: Attached to resources (S3 buckets, SQS queues)
25- **Permission boundaries**: Maximum permissions an identity can have
26- **Service control policies (SCPs)**: Organization-wide limits
27 
28### Roles
29 
30Identities with permissions that can be assumed by trusted entities. No permanent credentials—uses temporary security tokens.
31 
32### Trust Relationships
33 
34Define which principals can assume a role. Configured via the role's trust policy.
35 
36## Common Patterns
37 
38### Create a Service Role for Lambda
39 
40**AWS CLI:**
41 
42```bash
43# Create the trust policy
44cat > trust-policy.json << 'EOF'
45{
46  "Version": "2012-10-17",
47  "Statement": [
48    {
49      "Effect": "Allow",
50      "Principal": { "Service": "lambda.amazonaws.com" },
51      "Action": "sts:AssumeRole"
52    }
53  ]
54}
55EOF
56 
57# Create the role
58…