Defining the "Whose" and the "What"

In the AWS world, IAM (Identity and Access Management) is the service that controls "Who can access what" and "What they can do." For an AI project, IAM is the "Invisible Forcefield" that prevents a junior developer from accidentally deleting your $100,000 SageMaker model.

---

1. The Principle of Least Privilege

This is a Universal AWS Exam Concept.

• Definition: Give a user/service only the permissions they need to do their job, and nothing more.
• Bad Example: Giving a "Data Labeler" full administrative access to your AWS account.
• Good Example: Giving a "Data Labeler" permission only to read from one specific S3 folder containing the images.

---

2. Users, Groups, and Roles

To manage AI security, you must understand the difference:

• Users: A person (like "Accountant John").
• Groups: a collection of users with similar needs (e.g., "The Data Science Team").
• Roles: An "Identity" that doesn't belong to a person, but can be "Borrowed" by a service.
  • Crucial Use Case: You give a Role to Amazon SageMaker so that it can "borrow" the permission to read your secret S3 bucket.

---

3. Resource-Based Policies (The "Bucket" Side)

Sometimes, you don't put the lock on the person; you put it on the object.

• An S3 Bucket Policy can say: "Only allow requests coming from this specific Bedrock API to see these documents."

---

4. Visualizing the IAM Handshake

graph LR
    subgraph Identity_Side
    A[Human: Data Scientist]
    B[Service: AWS Lambda]
    end
    
    subgraph The_Role
    C[IAM ROLE: 'AI-Reader-Only']
    end
    
    subgraph The_Resource
    D[SageMaker Model]
    E[Secret S3 Bucket]
    end
    
    A -->|Assumes| C
    B -->|Assumes| C
    C -->|Can READ| D
    C -->|Can READ| E
    C --X|CANNOT DELETE| D

---

5. Summary: Security through Granularity

A Practitioner ensures that:

• Every developer has their own login (MFA - Multi-Factor Authentication enabled!).
• Services are given Roles, not hard-coded passwords.
• Permissions are narrowly defined to specific services (e.g., bedrock:InvokeModel).

---

Exercise: Identify the IAM Action

A security engineer needs to give an automated AWS Lambda script the ability to call Amazon Transcribe every time a new audio file is uploaded to S3. Which IAM component should they use for the Lambda script?

• A. IAM Group.
• B. IAM Password.
• C. IAM Role.
• D. IAM Root User.

The Answer is C! Applications and services "Assume" IAM Roles to get the specific temporary permissions they need to interact with other AWS services.

---

Knowledge Check

What's Next?

Security isn't just "Your" job; it's a partnership. In the next lesson, we see the most famous security model in cloud computing: The AWS Shared Responsibility Model (AI/ML version).