IAM Demo

In this guide, we'll demonstrate AWS Identity and Access Management (IAM) by working with users, groups, roles, and customizable permissions and policies. These features enable you to control which resources users can access in your AWS account.

If you haven't already, visit aws.amazon.com and click the "Sign into the Console" button in the top-right corner to log into your AWS Console.

There are two primary login methods: as the root user or as an IAM user. When you create an AWS account, a root user is automatically generated with full access, using the registration email as the login. However, for everyday tasks, it is highly recommended to create a separate IAM user with restricted permissions.

Enter your email and password. If you have multi-factor authentication (MFA) enabled, provide the MFA code. Note that using the root account for daily operations is not secure. Instead, create an IAM user with limited permissions to enhance security.

To get started, navigate to the IAM service. If IAM isn’t visible under "Recently Visited," type "IAM" in the search bar and select it. The IAM dashboard provides you with options to manage users, groups, roles, and policies.

Creating an IAM User

Follow these steps to create an IAM user:

1. Navigate to the Users section.
2. Click Add Users.
3. Enter a username (for example, "Sanjeev") and select the checkbox for "Provide user access to AWS Management Console".

4. Choose whether to auto-generate a password or set one manually. For this demonstration, specify the password and disable the "users must create a new password at next sign-in" option.
5. Click Next.

Setting User Permissions

By default, a new IAM user receives no permissions. You can provide permissions by:

• Adding the user to an existing group.
• Copying permissions from another user.
• Attaching policies directly.

For now, create a blank account (no permissions assigned) and click Next.

Review the settings and then click Create User.

After creation, the users list displays "Sanjeev" with no group associations and disabled multi-factor authentication.

Logging in as an IAM User

To log in as the newly created IAM user "Sanjeev":

1. Open a new browser tab or an incognito window.
2. Select the "IAM user" sign-in option (not the "root user" sign-in).
3. Enter your AWS Account ID. You can find this by clicking your account name in the root session and copying the account ID.
4. Enter the username ("Sanjeev") and the previously specified password.

After logging in, the console displays the username "Sanjeev" along with the account ID. However, since no permissions have been granted, any attempt to perform actions such as creating an S3 bucket results in an error due to insufficient permissions.

For instance, attempting to create an S3 bucket produces an error message similar to "S3 Create Bucket permissions are required."

Granting Permissions via the Root User

Since the IAM user "Sanjeev" lacks permissions, you must use the root account to grant the required policies:

1. Switch back to the root user session.
2. In the IAM console, open the Users section and select the "Sanjeev" user.
3. Navigate to the Permissions tab and click Add permissions.
4. Choose "Attach policies directly" and select the AWS managed policy "AdministratorAccess" for full access.

Click the plus icon on the "AdministratorAccess" policy to review its JSON content:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "*",
      "Resource": "*"
    }
  ]
}

Click Next and then Add permissions. Now, the "Sanjeev" user has full administrator access.

Return to the IAM user session. To verify the permissions, list the S3 buckets, which should now be visible, and test by creating a new bucket (e.g., "KodeKloudTest12345").

Managing Permissions with Groups

For organizations with multiple employees requiring similar permissions, using AWS groups simplifies permission management. Instead of assigning permissions individually, create groups and attach the necessary policies.

1. Optionally, remove any existing direct permissions from the "Sanjeev" user.
2. Create a new group (e.g., "Admin") and add users who require administrative access.
3. Attach the "AdministratorAccess" policy to this group and create the group.

After adding users to the "Admin" group, permissions are inherited by group members. For instance, if you later create a "Monitoring" group, assign users who require read-only access, and attach the "ReadOnlyAccess" policy, those users will be limited to viewing AWS resources.

A user can belong to multiple groups. For example, if "Sanjeev" is part of both "Admin" and "Monitoring" groups, he inherits permissions from both. Removing him from the "Admin" group will leave him with only the read-only permissions from the "Monitoring" group.

When a read-only user tries to delete an S3 bucket, they will receive a permissions error.

Using Roles for Temporary Permissions

AWS IAM roles allow users or services to assume temporary permissions. For example, a user with read-only access can temporarily assume a role with enhanced permissions to modify S3 buckets.

To create a role:

1. Open the Roles section in the IAM console.
2. Click Create Role.
3. Select "AWS account" if the role will be assumed within your account.
4. Click Next, then attach the required permissions, such as the AWS managed "S3FullAccess" policy.

Review the S3 Full Access policy, which is similar to:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:*",
        "s3-object-lambda:*"
      ],
      "Resource": "*"
    }
  ]
}

5. Name the role (for example, "S3FullAccess") and complete the creation process.

Restricting Role Assumption to Specific Users

To ensure that only designated users (e.g., "Sanjeev") can assume the S3FullAccess role, attach an inline policy to that user:

1. In the IAM console, navigate to the "Sanjeev" user.
2. Click Add Permissions and select Create Inline Policy.
3. For the service, choose STS, and under actions, select AssumeRole.
4. Specify the role's ARN. Use the provided interface to add the ARN by entering the role name.

5. Review and create the policy, naming it (for example, "AssumeS3Access"). The resulting policy will look similar to:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "VisualEditor0",
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "arn:aws:iam::841860927337:role/S3FullAccess"
    }
  ]
}

Now, only the "Sanjeev" user is allowed to assume the S3FullAccess role. To test this:

1. Go to the Roles section and select the "S3FullAccess" role.
2. Click the Switch Role link.
3. Paste the provided URL in the "Sanjeev" session. The switch role page will auto-fill the AWS account, role name, and let you set a display name (e.g., "S3 role") along with a color.
4. Click Switch Role.

After switching, a badge labeled "S3 role" with your chosen color confirms that you are operating under the S3FullAccess role. With full access to S3, you can now perform actions like deleting an S3 bucket.

For example, try deleting the "Sanjeev KodeKloud" bucket:

Once the deletion is successful, switch back to your regular user session by clicking Switch Back.

Summary

In this guide, we covered how to:

• Create IAM users and provide access to the AWS Management Console.
• Grant permissions directly and through groups to efficiently manage multiple users.
• Utilize IAM roles for temporary permission elevation.
• Secure role assumption using precise AWS STS policies.

By following these steps, you can enhance your AWS account security by applying the principle of least privilege while maintaining flexibility in user access management. For more detailed information on AWS IAM, visit the AWS Documentation.