Demo Creating IAM Role

In this step-by-step guide, you'll learn how to create an AWS Identity and Access Management (IAM) role that grants an Amazon EC2 instance permission to read objects from an S3 bucket named company1-logs. By leveraging IAM roles, you avoid hardcoding credentials on your server and follow AWS best practices for secure access management.

Prerequisites

• An AWS account with administrative privileges
• A running EC2 instance
• An existing S3 bucket named company1-logs

Step 1: Create the IAM Role

1. Open the IAM console, select Roles, then click Create role.

2. On Select trusted entity, choose AWS service.
   

3. Under Use cases for other AWS services, select EC2.
   

4. Click Next to move to the permissions page.

5. In Permissions, search for company1 and select the Company1 logs policy which grants s3:GetObject access to the company1-logs bucket.
   

6. Click Next, then enter a Role name (e.g., Company1-Logs-Role) and an optional description.
   

7. Review the Trust relationship to ensure EC2 can assume this role. It should resemble:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": ["sts:AssumeRole"],
         "Principal": {"Service": ["ec2.amazonaws.com"]}
       }
     ]
   }
   

8. (Optional) Add tags to categorize your role, then click Create role.

Step 2: Attach the IAM Role to Your EC2 Instance

1. Go to the EC2 console, select Instances, and choose your running instance.
2. From the Actions menu, select Security > Modify IAM role.
3. In the IAM role dropdown, pick Company1-Logs-Role.
   
4. Click Update IAM role to apply the change.

Your EC2 instance now inherits the permissions defined in Company1-Logs-Role, allowing it to securely read log files from the company1-logs bucket without embedded credentials.

References

• AWS IAM Roles Documentation
• Amazon EC2 IAM Roles
• Managing Access to S3 Buckets