AWS Security: IAM (Identity & Access Management)

 

Creating users / Creating User Groups / Creating Roles / Creating Policies / Check Identity Providers / Account settings 

Activity: Create a New User and put the user into a New Created Group with EC2FullAccess.

Step 1: Select IAM service

Step 2: Click on Users Link on the left panel

Step 3 Add users by providing user name(s), Max 10 users at a time you can create using IAM.

Step 4: Select Access Type: Check both Programmatic Access and Console Access

• Programmatic:- If a user connects to AWS using a program or Aws CLI then you need to provide the programmatic access. It is has confidential information like 
• Secret key
• Access Key
• Username
• Password
• Console:- If user connects to AWS using console then you need to provide userid and initial password to connect a user to AWS console.

Step 5: Console password:- select the option Autogenerated Password.

Step 6: Select Required Password reset.

Step 7: Click on Next Button

Step 8: Create a Group here by clicking on Create Group (You can also create the group before user creation ).

• Group name: <groupname>
• Attach a policy: AmazonEC2FullAccess
• Click on Create Group button.

Step 9: Click on Next Add Tags button

• you can add max 50 tags
• Click on Next button

Step 10: Review and Click on Create Users button.

Step 11: Download user details in csv files and you can share this information to the respective users.

Experiment

You can try by yourself to connect to AWS Console using the "Console Login Link" and check out that you have only access to EC2 services.

Ans: Yes

Add S3full access permission to Group DevGrp and again check that users have S3 access as well.

Ans: Yes

Delete the user and Group.

Ans: Ok

Create a user (providing programmatic and console access)  without assigning to a group and check whether you are able to assign permission to that user.

Ans: Yes able to assign permission (Attach existing policies directly)

Add a user to multiple groups and provide permission for the first Group as EC2FullAccess and second Group AmazonS3FullAccess and log in with console access and check whether the user can have both s3 and EC2FullAccess.

Ans: Yes (permissions attached from group)

Delete a Group and check the users also get deleted or not.

Ans: Groups that the user were in are deleted but the user is not deleted.

ASSIGNMENT: AWS Management - IAM

The developer is developing index.html file , implementer is hosting that file on S3 and Tester is testing that file

1. Create groups called Developer  and Tester and implementer

Ans: Ok

2. create some users in Developer and Tester groups

Ans: Ok

3. Developers and Tester has readonly access to S3 buckets and Implementer has full access to S3 buckets

Ans: Developers - AmazonS3ReadOnly, Testers - AmazonS3FullAccess

4. Developers can access the S3 buckets using programs.

Ans: Developers - Programmatic Only (Share only Username and Password)

5. Testers can not access the S3 buckets using progs but there are some dedicated machines allocated to tester for Testing purpose so that they can access S3 buckets. 

Ans: Testers - Console only (Share only Access Key and Secret Key)