How IAM is used to securely manage access
Managing user identities with long term credentials in IAM
Managing access using IAM user groups & roles
Using IAM policies to define and manage permissions
AWS Web Application Firewall
AWS Firewall Manager
AWS Security Hub Overview
Other AWS Security Services
The course is part of this learning path
This course looks at the key Security services within AWS relevant to the Solution Architect associate exam. Core to security is Identity & Access Management, commonly referred to as IAM. This service manages identities and their permissions that are able to access your AWS resources and so understanding how this service works and what you can do with it will help you to maintain a secure AWS environment. IAM is an important service in ensuring your resources are secure.
Want more? Try a lab playground or do a Lab Challenge!
- Learn about identity and access management on AWS including users, groups & roles, IAM policies, MFA, identity federation, and cross-account access
- Learn the fundamentals of AWS Web Application Firewall (WAF) including what it is, when to use it, how it works, and why use it
- Understand how to configure and monitor AWS WAF
- Learn about AWS Firewall Manager and its components
- Learn how to configure AWS Shield
- Learn the fundamentals of AWS Cognito
When creating a new user, you have the option to create it via the AWS Management Console or programmatically via the AWS CLI, Tools for Windows PowerShell, or using the IAM HTTP API. For this lecture, I should be using the AWS Management Console to demonstrate how to configure Users. User object creation is a simple process. Firstly, you will set the user details by creating a username, which can be up to 64 characters in length. Next you'll select the AWS access type, either AWS Management Console access or programmatic access.
For programmatic access, an access key ID and secret access key ID will be issued to be used with the AWS CLI, SDKs or other development tools. If console access is required, you will need to define a console password for the user. Permission assignment through the use of policies can be attached to the user or inherited from a group that the user can be assigned to. And permission boundaries can also be applied to the user, controlling their maximum permission level. You can assign any tags to the user as you would with any other AWS resource. And then you must review and confirm the information that has been submitted before you create the user.
Once the user is created, you can download the security credentials via a CSV file. And that will contain the username, access keys required for programmatic access and the console login link. So let me now jump into the console to demonstrate how to create a new user. Okay, so I've just logged into my AWS Management Console. And the first thing I want to do is to go to IAM. And that can be found under the Security, Identity and Compliance category.
So if we select IAM, and that will take us straight to the IAM dashboard. And this is where we can start creating our users and groups and roles, et cetera, and anything else that we need to manage within IAM. So to create a new user, I need to go across to Users on the left here. And then from here, I can select Add users.
Now the first thing I need to do is to create the username of the user. So I'm going to call this user Patricia. And then we can select the access types. So we have the programmatic access here, all the AWS Management Console access here. So for this user, let me add both. So I want them to have programmatic access and also AWS Management Console access. So I'm going to select both. So for the AWS Management Console access, we need to enable a password so we can either have IAM auto-generated password or I can select my own. And for this demonstration, I'm going to add in my own password.
Now if you tick this option here, when the user signs in, they will be asked to generate their own password once they've used your initial password to login. And that's a great idea, just to enhance security there. So if we click on Next, then we can assign permissions. And here we have a couple of options so we can add the user to an existing group. We can copy permissions from another user or attach existing policies directly to the user. So for best practice, I'm just going to add this user to a couple of different groups. So I'm gonna add them to the CloudAcademy group, and also to the RDSFullAccess.
So once you've selected the groups that you want the user to have, you can click on Next to go to tags. And this is an optional step. You can add any key value tags here for that user if you want to. Just gonna leave that blank for this demonstration. Then if we go to Next to Review, then we can review all the options that we've set. So we've given the username. We specify the access types. So you've got programmatic and AWS Management Console access. We've not set any permission boundaries. We've added the groups that we want the user to belong to and we haven't applied any tags.
So now, we can go to Create User. Now we've successfully created the IAM user, but because we specified that we wanted programmatic access, we need to copy the access key ID and also the secret access key ID as well. If we download the CSV file of that user and take a look at that, we can see here that this CSV file shows the access key ID and also the secret access key ID, and also the console link as well to allow that user to login. So if we go back to the AWS Console, we can also email those login instructions to the user as well if we need to. Once you've taken a copy of the access key ID and the secret access key, then you can close this window. Remember, you will only be given one opportunity to take these details and download the CSV that contains that information, so make sure you do that. Then click on Close. And we can now see that that user, Patricia, has been set up as a user with the CloudAcademy and RDSFullAccess groups. So it's very simple. It's very quick. It's very easy to set up a new user within IAM.
Stuart has been working within the IT industry for two decades covering a huge range of topic areas and technologies, from data center and network infrastructure design, to cloud architecture and implementation.
To date, Stuart has created 150+ courses relating to Cloud reaching over 180,000 students, mostly within the AWS category and with a heavy focus on security and compliance.
Stuart is a member of the AWS Community Builders Program for his contributions towards AWS.
He is AWS certified and accredited in addition to being a published author covering topics across the AWS landscape.
In January 2016 Stuart was awarded ‘Expert of the Year Award 2015’ from Experts Exchange for his knowledge share within cloud services to the community.
Stuart enjoys writing about cloud technologies and you will find many of his articles within our blog pages.