IAM 角色与权限

Welcome! In serverless applications, security is paramount. AWS Identity and Access Management (IAM) is your key tool for managing who (or what) can do what in your AWS account.

For Lambda functions, IAM roles define the permissions your function needs to interact with other AWS services, like reading from a database or writing logs.

AWS IAM stands for Identity and Access Management. It's a service that helps you securely control access to AWS resources.

• You can manage users, groups, and roles.
• You define permissions using policies.
• It ensures only authorized entities can perform actions.

Think of it as the security guard and rulebook for your AWS cloud.

An IAM Role is a set of permissions that you can assign to AWS services (like Lambda) or users who need to perform actions in your account.

Unlike users, roles don't have standard long-term credentials (like passwords). Instead, they are "assumed" by an entity, providing temporary security credentials.

Your Lambda function will assume an IAM role to get the permissions it needs.

IAM Policies are JSON documents that explicitly state what actions are allowed or denied on which AWS resources.

When you create an IAM role, you attach one or more policies to it. These policies dictate what the role (and thus your Lambda function) is permitted to do.

Policies are the core of IAM security!

IAM policies have a specific structure, typically including these key elements:

• Effect: Whether to Allow or Deny an action.
• Action: The specific AWS API calls allowed (e.g., s3:GetObject, dynamodb:PutItem).
• Resource: The AWS resources the action applies to (e.g., an S3 bucket, a DynamoDB table).

These elements combine to form a clear permission statement.

Every IAM role has a Trust Policy. This policy specifies which entities are allowed to "assume" (use) that role.

For a Lambda execution role, the trust policy typically allows the Lambda service itself to assume the role. This is crucial for your function to operate.

The principal in the trust policy for Lambda is usually lambda.amazonaws.com.

Beyond assuming the role, your Lambda function needs permissions to interact with other services. A common requirement is to write logs to AWS CloudWatch.

This policy grants the necessary logging permissions:

A core security best practice is the Principle of Least Privilege. This means you should only grant the minimum permissions necessary for a function or user to perform its intended task.

• Avoid giving * (all) permissions if specific actions are sufficient.
• Limit resource scope (e.g., specific S3 bucket, not all S3 buckets).
• Regularly review and remove unused permissions.

This reduces the potential impact if a role or function is compromised.

Great job! You've learned the fundamentals of securing your serverless applications using AWS IAM.

• IAM Roles provide temporary credentials for services like Lambda.
• IAM Policies define permissions using JSON.
• Key policy elements are Effect, Action, and Resource.
• Always follow the Principle of Least Privilege.

Proper IAM configuration is vital for robust and secure serverless architectures!