Should you use AWS IAM roles and permission for application users?

Question

I'm working on a nodejs application on AWS for the first time and am still learning all the services. I'm working on my applications authentication and authorization and am at the point to create my user roles and groups. Is the AWS IAM service meant for both AWS management and for your application's user authorization or should I use one of nodejs's ACL modules and manage my roles and users outside of AWS IAM service?

Rodrigo Murillo · Accepted Answer · 2016-01-11T15:49:29.157

11

Should you use AWS IAM roles and permission for application users?

No, you should not. AWS IAM roles and permission control AWS user/instance access to AWS services only via EC2 user profiles and instances. They are not intended to be used for specifying user authentication or roles in a proprietary application.

Should I use one of nodejs's ACL modules and manage my roles and users outside of AWS IAM service?

Yes, correct. Use native methods/libraries for managing application specific user authentication and roles in your app.

edited Jan 11 '16 at 15:49

answered Jan 09 '16 at 15:41

Rodrigo Murillo

13,080
2
29
50

Thanks for the direct answers to my questions. This confirms my speculation. – Nikordaris Jan 09 '16 at 22:55

score 5 · Answer 2 · answered Apr 25 '16 at 08:07

5

With the rise of API gateway and lambda, I'm wondering if this advice still holds true.

i have a very simple API in node, which is pretty much just ACL around storing a blob of JSON in mongo.

If i could model my permissions in IAM and use a lambda function for handling the mongo write/read, it would seem sensible to use IAM for my application user creds.

Possibly this is what Cognito was released to support? (although i haven't looked into this much)

answered Apr 25 '16 at 08:07

Chris Matheson

348
2
7

1

Thanks for the tip about Cognito. I'll do more research on it but at first glance it does seems to be the service I was looking for. – Nikordaris Jul 19 '16 at 08:40

score 3 · Answer 3 · answered Jan 09 '16 at 12:05

AWS IAM users are used to share your Amazon services with someone (your team for example) without having to disclose your personal password.

One of the key advantages is being able to give admin access to any staff member without allowing it to access your credit card data.

If you need to create a simple authentication module for your application or website (a common case of system with username and password) then you can try using something like PassportJS

Thanks for the PassportJS suggestion. I hadn't seen that one yet in my brief research. — Nikordaris, Jan 09 '16 at 22:53

Should you use AWS IAM roles and permission for application users?

3 Answers3

Linked