Accounts, users, and the root user

Security before servers

We cover identity before any real service on purpose. Almost every serious cloud breach starts with a stolen or over-powered credential, not a hacked server.

An AWS account is the container for everything: your servers, your data, and your bill. When you create one you get the root user, an identity with unlimited power that cannot be restricted. Root can delete every server, empty every storage bucket (a bucket is S3's named container of stored files — unit 4 covers S3 properly), and close the account.

The first rule of AWS: lock root away. Turn on MFA (multi-factor authentication), a second login step from your phone, then stop using root for daily work. Instead you create IAM users.

IAM (Identity and Access Management) is the free service that answers one question on every single API call: is this identity allowed to do this action on this resource?

Users, and how they log in

An IAM user is a named identity inside your account, like ben or ci-deployer. Each one gets its own credentials:

• a password for the web console (the point-and-click website), and
• access keys for the command line and code: an ID plus a secret, like a username and password for programs. The aws CLI you will see in this course signs every request with them.

One more term you will meet constantly: least privilege. Give every identity the smallest set of permissions that lets it do its job, nothing more. The deploy robot that uploads files to one bucket should be able to do exactly that, not delete databases.