Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Identity and access management for Amazon EC2

Your security credentials identify you to services in Amazon and grant you unlimited use of your Amazon resources, such as your Amazon EC2 resources. You can use features of Amazon EC2 and Amazon Identity and Access Management (IAM) to allow other users, services, and applications to use your Amazon EC2 resources without sharing your security credentials. You can use IAM to control how other users use resources in your Amazon account, and you can use security groups to control access to your Amazon EC2 instances. You can choose to allow full use or limited use of your Amazon EC2 resources.

For best practices for securing your Amazon resources using IAM, see Security best practices in IAM.

Network access to your instance

A security group acts as a firewall that controls the traffic allowed to reach one or more instances. When you launch an instance, you assign it one or more security groups. You add rules to each security group that control traffic for the instance. You can modify the rules for a security group at any time; the new rules are automatically applied to all instances to which the security group is assigned.

For more information, see Security group rules.

Amazon EC2 permission attributes

Your organization might have multiple Amazon accounts. Amazon EC2 enables you to specify additional Amazon accounts that can use your Amazon Machine Images (AMIs) and Amazon EBS snapshots. These permissions work at the Amazon account level only; you can't restrict permissions for specific users within the specified Amazon account. All users in the Amazon account that you've specified can use the AMI or snapshot.

Each AMI has a LaunchPermission attribute that controls which Amazon accounts can access the AMI. For more information, see Make an AMI public.

Each Amazon EBS snapshot has a createVolumePermission attribute that controls which Amazon accounts can use the snapshot. For more information, see Share an Amazon EBS snapshot in the Amazon EBS User Guide.

IAM and Amazon EC2

IAM enables you to do the following:

By using IAM with Amazon EC2, you can control whether users in your organization can perform a task using specific Amazon EC2 API actions and whether they can use specific Amazon resources.

This topic helps you answer the following questions:

Create users, groups, and roles

You can create users and groups for your Amazon Web Services account and then assign them the permissions they require. As a best practice, users should acquire the permissions by assuming IAM roles.

An IAM role is an IAM identity that you can create in your account that has specific permissions. An IAM role is similar to an IAM user in that it is an Amazon identity with permissions policies that determine what the identity can and cannot do in Amazon. However, instead of being uniquely associated with one person, a role is intended to be assumable by anyone who needs it. Also, a role does not have standard long-term credentials such as a password or access keys associated with it. Instead, when you assume a role, it provides you with temporary security credentials for your role session. For more information on how to create IAM roles and grant permissions with them, see IAM roles for Amazon EC2.

Related topics

For more information about IAM, see the following: