Controlling Access

Role-based access control (RBAC) is a major approach for managing permissions and access to resources in AWS.

With RBAC, access is determined by assigning users to roles that have been pre-defined with specific privileges associated with them. For example, a developer role might have permissions to create, delete, and modify resources in services such as EC2, S3, and DynamoDB. Meanwhile, a security analyst role has read-only access to some logging and monitoring services. As new employees join, they are assigned the appropriate role(s) for their job function. Roles simplify administration since privileges are tied to the role, not each individual user. Changing permissions means updating the role rather than many user accounts. Please see Chapter 3, Identity and Access Management, for more information about identity and access management (IAM) and RBAC.

In addition to IAM roles, RBAC can be applied across several other AWS services. S3 buckets can have...