IAM in twenty-five slides — an intro on what IAM is and the three steps of every request, then identification (identities, principals, the access key ID), authentication (the secret and the signature, long-term and temporary keys, the console's temporary credentials), authorization (the request context, policies and their evaluation), roles (trust policies, AssumeRole and STS, switching role, session lengths, STS behind the console) and least privilege.
The slides
The tool is twenty-five slides: an introduction, then five sections, listed on its left.
- 0. Introduction
- IAM: identification, authentication, authorization: what IAM is, and the three steps every request goes through.
- 1. Identification
- The identities in an account: the root user, and the users, groups and roles we create.
- IAM identities: what each kind is.
- A request: principal, action, resource: the three parts of every request, and IAM's one question about them.
- Identities and principals: which identities send requests, and how a role becomes a principal through a session.
- The access key ID: the ID AWS finds a principal by; a user's
AKIA… IDs, and an ASIA… ID for each role session.
- 2. Authentication
- The secret access key: signing a request: the secret signs, and never travels.
- Long-term and temporary access keys:
AKIA… keys live until deleted, ASIA… keys end with their session; STS issues them. - The console's temporary credentials: a real CloudTrail record of a console request, signed with an
ASIA… key.
- 3. Authorization
- The request context: the principal, the action, the resource and the context, read off a real request.
- A policy document: Effect, Action, Resource and Condition.
- Identity-based and resource-based policies: managed, inline, and policies on a resource.
- A user in the IAM console: a user who gets her policy from her group.
- Naming a principal in a policy: the forms of the
Principal element. - Policy evaluation: allow, deny, default deny: matching the context against the policies, and a real denial.
- 4. Roles
- A role: an identity to assume: the trust policy, the permissions policies, and the session.
- A role in the IAM console: the trust policy, the maximum session duration and Revoke sessions.
- AssumeRole, step by step: the caller, STS, and the service with IAM behind it.
- AssumeRole from the CLI: a real run, from the user to the role session and its first denial.
- The length of a role session: from 15 minutes up to the role's maximum.
- Switching role in the console: the Switch Role page and the account menu after it.
- The role session's permissions: the console's denial, naming the session.
- STS behind the scenes: the console, CloudShell,
aws login and Switch Role.
- 5. Least privilege
- The root user and the everyday admin: what to keep the root user for.
- Access keys or roles: which to use where.
The buttons on the left and right edges move between slides. So do the arrow keys and a swipe.
The demo identities
The console screenshots, the CloudTrail record and the CLI run come from a real account on 2026-11-13. The user
demo-alice, the group demo-developers, the policy demo-s3-read and the role demo-s3-reader were made for them and
deleted after. The account ID and the user's name are covered in the screenshots; in the text they are AWS's
placeholders (111122223333, admin), and so are the keys.
Sources
We checked the slides against AWS's documentation on 2026-11-13.