-In this demo, we will get introduced to the IAM service
using the AWS management console.
We will create users, group policies,
create a custom IAM policy, and finally create an IAM rule.
To go to the IAM service we can use the services tab on the top left
and then navigate to the group called security and compliance.
The IAM service should be the very first service listed under this group.
What I need to leave, we can also search for the IAM service
from the service search bar on the dashboard.
You will also notice that when we are working with IAM,
the region is set to global.
This is because unlike other AWS services, IAM is independent of the region.
Once we create IAM objects such as a user or a group,
it will be available in all regions and the account.
We are now in the IAM dashboard.
Since we just created this account,
there are no users or groups created at this point.
Remember, right now we have logged into the console using the root account.
First, let's create an IAM user called Lucy.
To do this, click on users under the account management.
Let's provide Lucy as the username.
Now we have an option to provide two types of access for the user.
The first one is programmatic access,
which creates an access key and a secret access key.
This allows the user to access AWS services, programmatically,
such as making use of the AWC ally.
The other is access to the management console with a username and a password.
Neither of these methods are an alternative for each other.
You need management access to log into the AWS management console
and you need the access key ID and the secret access key
to be able to access AWS programmatically.
Let's also provide a custom password and allow password to be reset by the user.
With this enabled, users will be automatically attached to IAM policy
that will allow them to reset their own password.
When ready, click on next permissions.
We're not going to add any permission at this moment so click on next.
We now have an opportunity to add tax for this user,
but let's move forward and click on next.
We can now review the details that we entered and finally click on create user.
Once the user has been created,
we get the option to download the access key and the secret access key folders user.
This is the only time where the secret access key is displayed
with an option to download.
Once we move past this stage, we cannot see the secret access key again,
and we will have to create a new one
should we still need to access AWS programmatically.
Click on the download button to save the key in a CSV file.
As you can see, a user called Lucy has now been created,
but this user is not part of an IAM group yet.
Let's click on the user.
Under the permission staff,
we can see that the policy called IAM user change password
is automatically attached to this user.
To inspect what this policy does, we can click on it and check out the GSN document.
Let us now attach under the policy to this user.
Since Lucy is the team lead
and needs unrestricted access to every service on this account,
let's attach the administrator access policy to this user.
We select this policy and click next.
Review the information provided and click on add permissions.
Lucy now has two policies attached to her IAM user account.
The administrator access policy is perhaps the simplest decent document.
It allows all actions for every resource on the account
as denoted by the star.
Now let's create a few more users.
Using the same process as before, let's create another user called Abdul,
but this time let's add him to a group.
Since we do not have a group right now, click on the create group button.
Let's call the group projects sapphine users
and to this group, let's attach an Amazon EC2 full access policy.
Click on next and let's add a tag this time
with the key of name and value of project sapphine users.
As before, once the user has been created,
we can download the access keys in a CSV file.
Let's now add another user called Lee
and this time, let's add him to the existing group called project sapphine users.
Both Abdul and Lee are now part of this IAM group and now have full EC2 access.
Let's add another policy to this group which grants full access to the S3 service.
Next, let's take a look at IAM policies.
As we saw in the previous lecture,
AWS provides hundreds of mannies IAM policies by default
such as the Amazon EC2 full access
and the Amazon S3 full access policies that we just used.
There are also policies for specific job functions
such as the administrator access and the billing policy.
Let's now create an easy to read only custom policy.
To do this, click on the create policy button on the top left.
Next select a service the policy is applicable for
in this example, let's select EC2 as the service.
Next, choose the actions permitted.
We want this policy to only allow read analyst actions.
We can also select which resources this policy can be applied on
such as a specific EC2 instance on the account.
For this demo, let's click on all resources.
Now click on review and provide a name for this policy.
Let's call it EC2-list-read.
The policy will now be available in the policy list.
We can review the GSN document
and see that it allows all actions of list and read on all EC2 resources.
This policy can now be attached to users, groups, or rules.
Similarly, let's create another policy
that allows all read analyst actions for S3 service.
Let's call it the S3 read only policy.
Once created a quick inspection of the GSN document
shows that this policy allows all read analyst actions on all S3 resources.
Let's now move on to rules.
In the previous lecture, we saw that rules can be used for a number of different use cases.
We can use them to allow access to users from a different AWS account.
We can also grant permissions to services,
to access other services within the same AWS account.
Let's create a rule for this use case now.
Click on rules and click on the create rule button.
First, we need to select the type of the trusted entity.
This could be a service or another AWS account
or the organization's corporate directory for example.
We want this rule to grant EC2 instances read only access to the S3 service.
Let's select AWS service as the trusted entity and within this, select EC2 as the service.
Click on next and now we can attach a policy to this rule.
Let's attach the customer is through read only policy that we just created.
Let's also add an appropriate tag.
Here we are providing a value of S3 read only role for EC2instances,
click on next and review the options that we provided.
Let's call the role S3 read only role
and awfully let's also update the description.
When ready, click on the create role button.
The role is now available for use and can be attached to an EC2 instance.
That's it for this demo in the next lecture,
we will see how to use Terraform to work with IAM service.