On AWS Organizations and AWS IAM
- IAM can control access to resources; you can create users and groups and configure allow/deny access.
- Organizations can create AWS accounts, group them (OU), and apply policies (SCP).
1. What they apply to
- Organizations targets AWS accounts, while IAM targets users.
- When Organizations applies an SCP to an account, every user in that account is affected.
- Organizations policies take precedence over IAM policies.
2. Extra capabilities
- Organizations manages backups, resources, security policies and more centrally.
- When Organizations applies an SCP to an account, all users of that account are affected.
- Organizations creates resource-governance boundaries per group (OU).
- IAM does access control on resources.
Use Organizations to apply a kind of guideline to accounts at the organization level — managing policies (backup, resources, security, etc.) and costs at the account/organization level.
When you want to fine-tune permissions per individual user, use IAM.
Governance refers to everything done to guarantee data security, privacy, accuracy, availability, and usability. It includes the actions people must take, the processes they must follow, and the technology supporting them throughout the data's entire lifecycle. — Google Cloud
IAM features
- Shared access to your AWS account
- You can grant others permission to manage and use the resources in your AWS account without sharing your password or access keys.
- Granular permissions
- You can grant different permissions to different people depending on the resource.
- For example, you can allow some users full access to EC2, S3, DynamoDB, RedShift, and other AWS services.
- For other users you can allow read-only access to some S3 buckets, permission to administer some EC2 instances, or access only to billing information.
- Secure AWS resource access for applications running on EC2
- For applications running on EC2 instances, IAM features let you provide credentials securely. These credentials grant the application permission to access other AWS resources.
- Examples of such resources include S3 buckets and DynamoDB tables.
- Multi-factor authentication (MFA)
- For stronger security you can add two-factor authentication to the account and to individual users. With MFA, the account owner or user must provide not only a password or access key but also a code from a specially configured device to work with the account.
- If you already use FIDO security keys with other services and their configuration supports AWS, you can use WebAuthn for MFA security.
- Identity federation
- You can grant temporary access to your AWS account to users who already have passwords elsewhere — a corporate network or an internet identity provider.
- Identity information for assurance
- If you use AWS CloudTrail, you receive log records containing information about who requested the resources in your account.
- PCI DSS compliance
- Eventually consistent
- Free to use
- AWS Identity and Access Management (IAM) and AWS Security Token Service (AWS STS) are features offered with your AWS account at no extra cost. You are billed only when you access other AWS services using IAM users or AWS STS temporary security credentials.
Accessing IAM
- AWS Management Console — the console is a browser-based interface for managing IAM and AWS resources. For details on console access to IAM, see Signing in to the AWS Management Console as an IAM user or root user.
- AWS command line tools let you run commands from your system's command line to perform IAM and AWS tasks. Using the command line can be faster and more convenient than the console. The command line tools are also useful when writing scripts that perform AWS tasks.
- AWS SDKs — AWS provides software development kits (SDKs) consisting of libraries and sample code for various programming languages and platforms (Java, Python, Ruby, .NET, iOS, Android, etc.). SDKs give you convenient programmatic access to IAM and AWS. For example, an SDK handles tasks like cryptographically signing requests, managing errors, and retrying requests automatically. For details on AWS SDKs, including how to download and install them, see the Tools for Amazon Web Services page.
- IAM HTTPS API — you can access IAM and AWS programmatically with the IAM HTTPS API, which lets you issue HTTPS requests directly to the service. When using the HTTPS API, you must include code that digitally signs requests with your credentials. For details, see Calling the IAM API using HTTP query requests and the IAM API Reference.
- AWS provides two sets of command line tools: the AWS Command Line Interface (AWS CLI) and the AWS Tools for Windows PowerShell. For installing and using the AWS CLI, see the AWS Command Line Interface User Guide. For installing and using the Tools for Windows PowerShell, see the AWS Tools for Windows PowerShell User Guide.
Reference
What is IAM? - AWS Identity and Access Management
Thank you for letting us know this page needs work. We're sorry we let you down. Please take a moment to tell us how we can improve the documentation.
— docs.aws.amazon.com
AWS Organizations features
Centralized management of all AWS accounts
- You can combine existing accounts into one organization and manage them centrally.
- You can create accounts that automatically become part of the organization and invite other accounts to join. You can also attach policies affecting some or all accounts.
Consolidated billing for all member accounts
- Consolidated billing is a feature of AWS Organizations. Using the organization's management account, you can consolidate all member accounts and pay their charges.
- In consolidated billing, the management account can also access the billing information, account information, and account activity of the organization's member accounts.
- This information can be used in services like Cost Explorer, which helps the management account improve the organization's cost performance.
Hierarchical grouping of accounts to meet budgeting, security, and compliance needs
- You can group accounts into organizational units (OUs) and attach different access policies to each OU.
- For example, if you have accounts that must access only AWS services meeting specific regulatory requirements, you can put those accounts into one OU.
- Then attach a policy to that OU that blocks access to services not meeting the regulatory requirements. OUs can be nested up to 5 levels deep inside other OUs, letting you organize account groups flexibly.
Policies that centralize control over which AWS services and API actions each account can access
- An administrator of the organization's management account can use service control policies (SCPs) to specify the maximum permissions for the organization's member accounts.
- In an SCP, you can restrict which AWS services, resources, and individual API actions the users and roles in each member account can access.
- You can also define conditions restricting access to AWS services, resources, and API actions. These restrictions override even the administrators of the organization's member accounts.
- When AWS Organizations blocks a member account's access to a service, resource, or API action, no user or role in that account can access it. The block still applies even if a member-account administrator explicitly grants those permissions in an IAM policy.
Reference
What is AWS Organizations? - AWS Organizations
What is AWS Organizations? AWS Organizations is an account management service that lets you consolidate multiple AWS accounts you've created into an organization and manage them centrally. Leveraging AWS Organizations' account management and consolidated billing features,
— docs.aws.amazon.com
Original (Korean): tistory — published 2023-02-22, migrated to this blog. This translation was generated with the help of AI.