Glossary of terms

Glossary of terms
AWS IAM
AWS Identity and Access Management, a web service that helps you securely control access to AWS resources.
User
An entity that you create in AWS IAM to represent the person or application that uses it to interact with AWS resources.
Group
A collection of IAM users. Groups let you specify permissions for multiple users, which can make it easier to manage permissions for those users.
Policy
A document that defines permissions. Policies can be attached to users, groups, or roles to define what actions they can perform on specified resources.
Role
An entity that defines a set of permissions for making AWS service requests. Roles are not associated with a specific user or group, but can be assumed by users, groups, or services.
Permission
The authorization to perform an action on a resource. Permissions are defined in policies and granted to users, groups, or roles.
Access Key
A long-name credential that consists of an access key ID and a secret access key. Access keys are used to make programmatic requests to AWS services.
MFA
Multi-Factor Authentication, an additional layer of security that requires users to provide two or more forms of authentication before they can access an AWS resource.
Policy Document
A JSON document that defines the permissions for a policy. Policy documents specify the actions that are allowed or denied, the resources to which the policy applies, and the conditions under which the policy is in effect.
Principal
An entity in AWS IAM that is allowed or denied access to resources. Principals can be IAM users, IAM roles, AWS accounts, federated users, or AWS services.
Resource
An entity in AWS that you can work with, such as an Amazon S3 bucket, an Amazon EC2 instance, or an Amazon RDS database.
Condition
A set of key-value pairs that define when a policy is in effect. Conditions can be based on attributes of the request, such as the time of day, the source IP address, or the user's MFA status.
Trust Policy
A document that defines which entities are allowed to assume a role. Trust policies specify the trusted entities that can assume the role and the conditions under which they can do so.
Inline Policy
A policy that is embedded directly into an IAM user, group, or role. Inline policies are defined as part of the user, group, or role, and are not separate objects.
Managed Policy
A policy that is created and managed independently of any IAM user, group, or role. Managed policies can be attached to multiple users, groups, or roles.
Resource-based Policy
A policy that is attached to a resource, such as an S3 bucket or an SQS queue. Resource-based policies define who can access the resource and what actions they can perform on it.
Service Control Policy
A policy that is attached to an AWS Organizations entity, such as an organizational unit or an AWS account. Service control policies define the permissions that apply to all accounts in the organization.
Cross-Account Access
The ability for one AWS account to access resources in another AWS account. Cross-account access is typically granted using IAM roles.
Access Control List (ACL)
A list of permissions that specifies which AWS accounts or users are allowed to access a resource and what actions they can perform on it.
Resource-based Access Policy
A policy that is attached to a resource and specifies who can access the resource and what actions they can perform on it. Resource-based access policies are used to control access to resources like S3 buckets and SQS queues.
Identity-based Policy
A policy that is attached to an IAM user, group, or role and specifies what actions they can perform on specified resources. Identity-based policies are used to control access to resources within an AWS account.
Least Privilege
The practice of granting only the permissions that are necessary for a user, group, or role to perform their intended tasks. Least privilege helps reduce the risk of unauthorized access to resources.
Policy Evaluation Logic
The process by which AWS IAM evaluates policies to denameine whether a request is allowed or denied. Policy evaluation logic considers the policies attached to the user, group, role, and resource, as well as any conditions that apply.
Policy Version
A unique identifier for a version of a policy document. Policy versions are created when a policy is updated, and can be used to track changes to the policy over time.