IAM (Identity and Access Management)

IAM → IAM (Identity and Access Management) in AWS is a service that helps you securely control access to AWS resources. It allows you to manage users, groups, roles, and permissions to ensure that the right people and services have the appropriate level of access.

We can create User - 5000

We can create Groups - 300

We can assign Roles - 1000

• Users

We have two categories of users: Root and IAM users

root -› Global Admin -› IAM Users

root users has full access. It creates global admin

Global admin has full access like root users, but it is also IAM user. It creates IAM users.

IAM users has limited access

Things to remember: Don't use the root user for everyday access/activity.

• Don't share root cred with anyone.

• Create an IAM user for yourself and then assign yourself administrative permission for your account.

• You can then sign in as that user to add more users as needed.

• IAM user can not delete root user

1. Shared access to your AWS account -> We can provide access without sharing our credentials and by creating IAM users

2. Granular permission -> root user can assign specific permissions like upload, delete, read or write to IAM users

- EC2 read, EC2 fullAccess, S3-bucket fullAccess

3. Secure access to AS resources for applications that run on EC2.

Users can not use the data but EC2 can fetch it.

• Steps to create IAM user

1. IAM - Users - Create user

2. Give user name - next

3. I want to create an IAM user - Custom password

4. Give password

5. Add user to group - next

6. Download .csv file

7. CSV file contains credentials of created user

8. Check IAM users at Users

9. Add user to group

   To add IAM user in specific group follow below steps:

   IAM - User group - Create user group- give name

10. Select users to add in group

11. Give permissions to user like admin/read/write

    When you give administrator access to user it will become Global user

12. Can check created groups as below

• AD (Active Directory) - Is a directory service developed by MS that provides a centralized management of network resources, users and computers.

IAM Terms -

Principle is making Request for Authentication

1. Principal - User, Role, federated users or application

federated user - Users from different organisations and domains are allowed to login are called federated users

for example, login with google here xyz company is allowing google users to login.

2. Request - Principal is making requests for authentication

3. Authentication - Login username or PWD

4. Authorization - Permission to allow any work/action

5. Action/Operation - Delete, create or modification.

6. Resource - On which actions are performed.

   e.g., EC2, VPC ,s3

IAM delegation -

• Delegation is granting permission to someone to allow access to resources that you control.

• Delegation involves setting up a trust between the account that owns resources (The trusting account) and the account that contains the users that need to access the resources (The trusted account)

• To delegate the permission to access a resource you create an IAM role that has two policies attached

1. The trust Policy

2. The permission Policy

1. Permission - Permissions like S3 bucket has permissions to Put/download/create/versioning, EC2 has permissions to read/create/delete/

2. Policy - It is a set of permissions -› S3 full access, EC2 full access

3. Role - Policy is assigned to role

4. Principal - Role is assigned to principal

• Role and Policy

To create Role follow below steps:

1. IAM - Roles - Create role

2. Select type as required. Here AWS service is selected

3. Add EC2 as service

4. Give permissions- S3 full access

• You can access S3 bucket through your EC2 instance in two ways:

1. With Access key and password

2. Assigning role to EC2 machine

Create EC2 and get access to your local

With access key and password

1. Check if you can access s3 - aws s3 ls - aws configure- key and password

Without access key and password

1. Create Role

2. Select service

3. Add EC2 as service

4. Give admin permission to EC2

5. Add role name and description

6. Roles - Ad admin full access -save

7. Now attach role to EC2

   Select EC2 - Actions - Security - Modify IAM role

8. Choose IAM role

9. Ad admin full access - save

10. Now test on console - aws s3 ls

11. create s3 bucket and EC2 instance for practice

Console Full Access → AWS ui console when you login through aws

Programmatic Full Access → login through access key and password on cli