Identity and Access Management for DevOps: Managing Human and Machine Permissions

This guide covers the critical aspects of Domain 6 (Security and Compliance) for the AWS Certified DevOps Engineer - Professional exam, focusing on identity management, multi-factor authentication (MFA), and temporary credentialing via STS.

Learning Objectives

After studying this guide, you should be able to:

• Distinguish between human and machine identities and their appropriate security controls.
• Implement Multi-Factor Authentication (MFA) across different identity types.
• Configure AWS Security Token Service (STS) for temporary, least-privilege access.
• Apply IAM Instance Profiles to securely provide credentials to applications.
• Scale permission management using Service Control Policies (SCPs) and Permissions Boundaries.

Key Terms & Glossary

• IAM User: A persistent identity used by a person or service to interact with AWS.
• IAM Role: An identity with specific permissions that can be assumed by anyone or anything that needs it.
• MFA (Multi-Factor Authentication): A security system that requires more than one method of authentication from independent categories of credentials.
• STS (Security Token Service): A web service that enables you to request temporary, limited-privilege credentials.
• Instance Profile: A container for an IAM role that you can use to pass role information to an EC2 instance.
• Least Privilege: The security principle of granting only the minimum permissions necessary to perform a task.

The "Big Idea"

[!IMPORTANT] Modern DevOps security shifts from long-term static credentials (like passwords and access keys) to temporary, short-lived tokens. By treating machine identities (EC2, Lambda) and human identities (Federated users) as temporary