iAM

Question 1

iAM Users and Groups

Answer 1

iAM is a global service.
User is single entity.
Groups only contain users

Question 2

iAM Policies

Answer 2

iAM Group is attached a policy which defines the access control to a resource
Structure is Effect (Allow/Deny), Action(API calls), Resource (What resource access is allowed)

Question 3

iAM Role

Answer 3

iAM roles are used by AWS services to access resources on users behalf.
Permissions are assigned to the iAM role in order to do that.
E.g. - EC2 instance roles, Lambda function roles, CloudFormation roles

Question 4

iAM Role application

Answer 4

1. Add new role
2. Choose the AWS service like EC2, Lambda, etc…
3. Attach a policy