> For the complete documentation index, see [llms.txt](https://kingkong.gitbook.io/kingkong/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kingkong.gitbook.io/kingkong/case/iam.md).

# IAM

## Top 10 AWS IAM BEST Practices

* users: create individual users
* permissions: Grant least priviledge
* groups: manage permissions with groups
* conditions: restrict priviledged access further with conditions
* auditing: enable cloudTrail to get logs of API calls
* password: configure a strong password policy
* rotate: rotate security credentials regularly.
* MFA: enable MFA (Multi-Factor Authentication) for priviledged users
* sharing: use IAM roles to share access
* roles: use IAM roles for EC2 instances
* root: reduce or remove use of root

以上是policy的一些基础用法，下面讲讲policy的执行规则，它也是几乎所有访问控制方案的通用规则：

* 默认情况下，一切资源的一切行为的访问都是Deny
* 如果在policy里显式Deny，则最终的结果是Deny
* 否则，如果在policy里是Allow，则最终结果是Allow
* 否则，最终结果是Deny

## 参考资料

<https://blog.csdn.net/whatnamecaniuse/article/details/78104189>

<https://www.jianshu.com/p/f59745ae7fad?utm_campaign=maleskine&utm_content=note&utm_medium=seo_notes&utm_source=recommendation>

<https://docs.aws.amazon.com/zh_cn/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Boolean>