AWS Principal vs Identity

In AWS IAM, both “principal” and “identity” refer to entities that can perform actions and interact with AWS resources. However, there is a subtle difference in their usage:

1. Principal: In the context of IAM policies, a principal represents the entity that is allowed or denied access to AWS resources. It can be an IAM user, an IAM role, an AWS service, or even an anonymous user (in certain cases). The principal is specified in the policy statement as the entity to which the permissions are granted or denied.
2. Identity: An identity, on the other hand, is a broader term that encompasses both the principal and the authentication credentials associated with that principal. It refers to the entity’s unique identifier, such as an IAM user’s username or an IAM role’s ARN (Amazon Resource Name). An identity is used for authentication purposes to verify the entity’s identity and determine its permissions.

In simpler terms, a principal is a specific type of entity that can take actions in AWS, while an identity is the unique identifier associated with that principal. The principal is defined in IAM policies to grant or deny access, and the identity is used for authentication and authorization purposes.

For example, an IAM user named “Shristi” is a principal, and her IAM username shristi@example.com is her identity. The policy statement can grant or deny permissions to the principal (Shristi), and when Shristi authenticates with her username and password, her identity is verified.

It’s important to understand this distinction when working with IAM policies and managing access to AWS resources.

Another example,

1. Principal (IAM Role): Let’s assume we have an IAM role named “MyRole” with an associated ARN (Amazon Resource Name). The IAM role acts as a principal that can be assumed by other entities to perform actions.

aws sts assume-role --role-arn arn:aws:iam::123456789012:role/MyRole --role-session-name MySession

In this case, “MyRole” is the principal, and the CLI command assumes the role using the provided ARN.

2. Identity (AWS CLI User): An identity refers to the IAM user associated with AWS CLI credentials. The user’s credentials are used for authentication and to perform actions on AWS resources.

To perform an action using the AWS CLI as an IAM user:

aws s3 ls --profile <myuser>

In this example, “myuser” is the identity of the IAM user configured in the AWS CLI profile. The user’s credentials are used to authenticate and authorize the CLI command to list the S3 buckets.