Amazon | IAM Done Right

Amazon | IAM Done Right

by Punim Menitesen (presenter, AWS) and Morgan Garland (host, WiCyS) · View the channel on PSI

Applied Sciences & Engineering Computing & Cybersecurity UComputing and Information TechnologyURComputer security
🎙 Punim Menitesen (presenter, AWS) and Morgan Garland (host, WiCyS) 👥 3K 📅 October 22, 2026 ⏱ 57 min 👁 2 📄 tutorial 🧭 2026-10-22
Available in: English (current) Français

Keywords

AWS IAMleast privilegeidentitycloud securityaccess control

Summary

The webinar, hosted by WiCyS, features Punim Menitesen, a senior delivery consultant at AWS, explaining best practices for AWS Identity and Access Management (IAM). The session begins with an introduction to WiCyS and a poll on viewers’ IAM maturity. The presenter then discusses why identity is the new security perimeter, emphasizing that every AWS action is an API call and must be authenticated. Common IAM mistakes are presented, including copy-pasted policies, over-privileged roles, long-lived access keys, root user misuse, lack of auditing, and loose trust policies. The fundamentals of IAM policy evaluation are covered, including principles, actions, resources, conditions, and the concept of explicit deny vs implicit deny. The distinction between identity-based and resource-based policies, guardrails like SCPs and permission boundaries, and the policy evaluation flow are explained. The session then focuses on achieving least privilege through a practical approach: start with AWS managed policies, observe usage via CloudTrail, refine with IAM Access Analyzer, and iterate. The presenter recommends replacing long-lived access keys with roles and temporary credentials. The webinar includes live console demonstrations and discusses scaling IAM across multi-account AWS Organizations. It concludes with a Q&A session and emphasizes continuous review as a key practice.

196 words

Critical Evaluation

Value of the Information & Strength of the Argument

The value of this webinar lies in its practical, field-tested advice for AWS IAM governance. The presenter effectively demonstrates how to structure policies, apply least privilege, and use AWS-native tools like CloudTrail and Access Analyzer to enhance security. The argumentation is logically structured, moving from conceptual foundations (why identity matters) to concrete implementation strategies and continuous improvement. The use of real-world breach examples and common misconfiguration patterns strengthens the argument, making a compelling case for adopting a systematic approach to IAM.

Scientific Rigor, Source Quality, Title Accuracy

The scientific rigor is moderate. While the presenter holds relevant professional certifications and cites industry-standard practices, no external scientific sources are referenced. The content is based on professional experience rather than empirical studies, but it aligns with widely accepted security principles such as least privilege and defense in depth. The title accurately captures the focus, and the webinar includes live demos that enhance credibility. No contradictory evidence is presented, and the advice is consistent with AWS official documentation.

174 words

Title / Content Match

The title accurately reflects the content, which focuses on best practices and practical guidance for AWS IAM.

Quality & Reliability

8/10

The webinar is presented by an AWS senior delivery consultant with over 15 years of security experience, providing practical and generally accurate guidance on IAM. It includes live demonstrations and references official AWS services, but lacks external citations and is based on personal experience rather than peer-reviewed sources.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

  • AWS Identity and Access Management (IAM) — Official AWS product page referenced as the foundational service discussed throughout.
  • AWS CloudTrail — Mentioned as the logging service used to observe API activity and inform least-privilege refinement.
  • AWS IAM Access Analyzer — Tool highlighted for generating policies based on observed usage, aiding in permission reduction.

Contribution & Novelties

The webinar provides a coherent, practical framework for implementing and maintaining AWS IAM, consolidating known best practices into a clear step-by-step methodology. Its novelty lies in the presentation style and the emphasis on iterative refinement using AWS-native services, rather than introducing new technical concepts. The presenter’s hands-on experience adds value through concrete examples and a focus on common pitfalls. Overall, it serves as a good tutorial for practitioners.

Pour aller plus loin :

  • AWS IAM Best Practices — Official AWS documentation detailing recommended IAM practices; complements the webinar’s guidance.
  • Principle of least privilege — A foundational security principle underpinning IAM policy design; relevant to the central theme.
  • NIST Cybersecurity Framework — A broader framework for managing cybersecurity risk, which includes identity management as a core function; useful for contextualizing IAM within organizational security.

133 words

Radar Profile

The radar profile shows high scores in quantite_information and fiabilite_globale, indicating a comprehensive and trustworthy presentation. The slightly lower qualite_information and niveau_technique scores reflect a practical orientation rather than deep theoretical or academic depth, which is consistent with a webinar aimed at practitioners.

Reliability 8/10