AWS SAA – Lecture 29: IAM Best Practices

Phase Verbs / Action Phrases

Phrase	Meaning
enforce (MFA)	require it — don’t make it optional
create (a user for someone)	set up a separate account rather than sharing
assign (users to groups)	put users into groups for permission management
generate (access keys)	create programmatic credentials for CLI/SDK use
never share (credentials)	never give your keys/passwords to others

Term	Definition
Root account	The master AWS account — created once, should almost never be used after initial setup
IAM User	Represents one physical person (1 user = 1 person)
Strong password policy	Rules that force complex, regularly changed passwords
MFA	Multi-Factor Authentication — adds a second layer beyond the password
IAM Role	Identity for AWS services (not people) to call AWS APIs
Credentials Report	Account-level audit tool showing all users’ credential status
Access Advisor	User-level tool showing which services a user actually accesses

Don’t use the root account for daily tasks — only for account setup
One AWS user = one physical person — never share credentials with a colleague; create a new user for them
Assign users to groups and manage permissions at the group level
Create a strong password policy — length, complexity, expiry, no reuse
Enforce MFA for root account and all IAM users
Use IAM Roles when granting permissions to AWS services (EC2, Lambda, etc.)
Generate access keys for programmatic (CLI/SDK) use — treat them like passwords
Audit permissions using Credentials Report and Access Advisor
Never share IAM users or access keys — ever