Creating IAM Users


Course Introduction
How IAM is used to securely manage access
IAM Features
PREVIEW10m 39s
Managing user identities with long term credentials in IAM
Creating IAM Users
Using IAM policies to define and manage permissions
Cross-account access
Fundamentals of KMS
What is Encryption?
AWS Web Application Firewall
AWS Firewall Manager
12m 16s
AWS Shield
AWS Secrets Manager

The course is part of this learning path

Creating IAM Users
4h 58m

This section of the AWS Certified Solutions Architect - Professional learning path introduces the key identity management, security, and encryption services within AWS relevant to the AWS Certified Solutions Architect - Professional exam. Core to security is AWS Identity & Access Management commonly referred to as IAM. This service manages identities and their permissions that can access your AWS resources, so understanding how this service works and what you can do with it will help you to maintain a secure AWS environment. IAM is an important service in ensuring your resources are secure.

Want more? Try a Lab Playground or do a Lab Challenge

Learning Objectives

  • Learn about identity and access management on AWS, including users, groups & roles, IAM policies, MFA, identity federation, and cross-account access
  • Learn the fundamentals of AWS Web Application Firewall (WAF), including what it is, when to use it, how it works, and why use it
  • Understand how to configure and monitor AWS WAF
  • Learn about AWS Firewall Manager and its components
  • Learn how to configure AWS Shield
  • Learn the fundamentals of AWS Cognito

When creating a new user, you have the option to create it via the AWS Management Console or programmatically via the AWS CLI, Tools for Windows PowerShell, or using the IAM HTTP API. For this lecture, I should be using the AWS Management Console to demonstrate how to configure Users. User object creation is a simple process. Firstly, you will set the user details by creating a username, which can be up to 64 characters in length. Next you'll select the AWS access type, either AWS Management Console access or programmatic access.

For programmatic access, an access key ID and secret access key ID will be issued to be used with the AWS CLI, SDKs or other development tools. If console access is required, you will need to define a console password for the user. Permission assignment through the use of policies can be attached to the user or inherited from a group that the user can be assigned to. And permission boundaries can also be applied to the user, controlling their maximum permission level. You can assign any tags to the user as you would with any other AWS resource. And then you must review and confirm the information that has been submitted before you create the user.

Once the user is created, you can download the security credentials via a CSV file. And that will contain the username, access keys required for programmatic access and the console login link. So let me now jump into the console to demonstrate how to create a new user. Okay, so I've just logged into my AWS Management Console. And the first thing I want to do is to go to IAM. And that can be found under the Security, Identity and Compliance category.

So if we select IAM, and that will take us straight to the IAM dashboard. And this is where we can start creating our users and groups and roles, et cetera, and anything else that we need to manage within IAM. So to create a new user, I need to go across to Users on the left here. And then from here, I can select Add users.

Now the first thing I need to do is to create the username of the user. So I'm going to call this user Patricia. And then we can select the access types. So we have the programmatic access here, all the AWS Management Console access here. So for this user, let me add both. So I want them to have programmatic access and also AWS Management Console access. So I'm going to select both. So for the AWS Management Console access, we need to enable a password so we can either have IAM auto-generated password or I can select my own. And for this demonstration, I'm going to add in my own password.

Now if you tick this option here, when the user signs in, they will be asked to generate their own password once they've used your initial password to login. And that's a great idea, just to enhance security there. So if we click on Next, then we can assign permissions. And here we have a couple of options so we can add the user to an existing group. We can copy permissions from another user or attach existing policies directly to the user. So for best practice, I'm just going to add this user to a couple of different groups. So I'm gonna add them to the CloudAcademy group, and also to the RDSFullAccess.

So once you've selected the groups that you want the user to have, you can click on Next to go to tags. And this is an optional step. You can add any key value tags here for that user if you want to. Just gonna leave that blank for this demonstration. Then if we go to Next to Review, then we can review all the options that we've set. So we've given the username. We specify the access types. So you've got programmatic and AWS Management Console access. We've not set any permission boundaries. We've added the groups that we want the user to belong to and we haven't applied any tags.

So now, we can go to Create User. Now we've successfully created the IAM user, but because we specified that we wanted programmatic access, we need to copy the access key ID and also the secret access key ID as well. If we download the CSV file of that user and take a look at that, we can see here that this CSV file shows the access key ID and also the secret access key ID, and also the console link as well to allow that user to login. So if we go back to the AWS Console, we can also email those login instructions to the user as well if we need to. Once you've taken a copy of the access key ID and the secret access key, then you can close this window. Remember, you will only be given one opportunity to take these details and download the CSV that contains that information, so make sure you do that. Then click on Close. And we can now see that that user, Patricia, has been set up as a user with the CloudAcademy and RDSFullAccess groups. So it's very simple. It's very quick. It's very easy to set up a new user within IAM.

About the Author
Learning Paths

Danny has over 20 years of IT experience as a software developer, cloud engineer, and technical trainer. After attending a conference on cloud computing in 2009, he knew he wanted to build his career around what was still a very new, emerging technology at the time — and share this transformational knowledge with others. He has spoken to IT professional audiences at local, regional, and national user groups and conferences. He has delivered in-person classroom and virtual training, interactive webinars, and authored video training courses covering many different technologies, including Amazon Web Services. He currently has six active AWS certifications, including certifications at the Professional and Specialty level.