Introduction to AWS Identity Access Management (IAM)

Launch this lab in the IP Lab Portal, then follow the steps below in the AWS console. Open IP Lab Portal

​

Overview

​

Lab details

1. This lab will cover the basics of AWS Identity and Access Management (IAM), which is a web service that helps the user securely control access to AWS resources. The motive of this lab is to walk the user through creating IAM users and adding them to IAM groups, along with permission policies, to provide access to various services in the AWS account.
2. Duration of the Lab: 30 Minutes
3. AWS Region: Global

​

Introduction

​

What is IAM?

• Stands for Identity and Access Management.
• IAM is a web service in AWS that helps manage user access to AWS resources.
• IAM allows you to create and manage AWS users and groups, and control their permissions to access AWS services.
• IAM provides a way to securely manage access to AWS resources, without having to share AWS account credentials.
• IAM is used to control who is authenticated and authorized to use AWS resources.
• The first identity in IAM is the root user, which has access to all AWS resources.
• The primary resources in IAM are users, groups, roles, policies, and identity providers.
• IAM roles are like IAM users, but they are intended to be assumed by anyone who needs them, and they do not have any credentials associated with them.
• IAM can be used from the AWS Management Console, AWS CLI, and AWS SDK.

​

Architecture diagram

​

Task Details

1. Sign into AWS Management Console.
2. Create IAM Users.
3. Create IAM Groups.
4. Validation of the lab

​

Launching the lab environment

1. To launch the lab environment, click on the Launch lab button.
2. Please wait until the cloud environment is provisioned. It will take less than a minute to provision.
3. Once the Lab is started, you will be provided with IAM username, Password, Access Key, and Secret Access Key.

​

Lab guide

​

Lab steps

​

Task 1: Sign in to the AWS Management Console

1. Click on the Open console button, and you will get redirected to AWS Console in a new browser tab. You’ll be automatically logged in to the AWS Console.
2. Once Signed In to the AWS Management Console, make the default AWS Region as US East (N. Virginia) us-east-1.

​

Task 2: Create IAM Users

In this task, we are going to create new IAM users by providing the name, password access, permissions, and tags. These users will be added to their respective groups in the next task.

1. Click on Services and select IAM under the Security, Identity, & Compliance section.
2. In the IAM dashboard, select the IAM Users option in the left panel and click on the Create User button to create a new IAM user.
3. In the Add User page, fill in the User Details section as follows:
   • User name: Enter John (or the desired name for the user)
   • Check the Provide user access to the AWS Management Console - optional checkbox
   • Select Custom password under Console Password and Enter whizlabs@123 (or the desired password for the user)
   • Uncheck the Users must create a new password at the next sign-in checkbox. (Recommended)
   • Click on the Next button.

• In the Set permissions section, keep things as default. Click on the Next button.
• Scroll down and Under Tags, Click on the Add new tag button:
  • Key: Enter Dev-Team
  • Value: Enter Developers
• Click on the Create User button
• Note: Ignore the above error if it appears while creating Users and click on Close.
• Click on the Return to users list button and then on the Continue button.
• Repeat the same steps and tags for the IAM user by the name Sarah*.*
• Repeat the steps to create IAM users by the name Ted and Rita with the following details,
  • Custom password: whizlabs@123
  • Key: HR-Team
  • Value: HR
• We have created 4 IAM users.

​

Task 3: Create IAM Groups and add IAM Users

In this task, we are going to create new IAM groups and will add the users to their respective groups. Moreover, we will be adding permissions to the group so that users within the group have access to the services allocated to them using the permission policies.

1. Select the User groups in the left panel and click on the Create group
2. Set Group Name:
   • User group name: Enter Dev-Team
   • Scroll down and select John and Sarah under Add Users to the group.
   • Scroll down to the Attach permissions Policies section and search for AmazonEC2ReadOnlyAccess and AmazonS3ReadOnlyAccess policies. These policies provide read access for EC2 and S3 to the added users in the group.
   • Note: Do not add other policies than the ones mentioned above. You will get an error while creating a group
   • Review all details and click on the Create group button.
   • Repeat the same steps to create an HR-Team group.
     • Click on the Create group
     • User group name: HR-Team
     • Scroll down and select Ted and Rita under Add Users to the group.
     • Under Attach permissions Policies, select the Billing policy.
     • Note: Do not add other policies than the ones mentioned above. You will get an error while creating a group
     • Review all details and click on the Create group button.

​

Task 4: Validation Test

1. Once the lab steps are completed, please click the Lab Validation button on the left side panel. Click Check my work on the Lab Validation tab.
2. This will validate the resources in the AWS account and display whether you have completed this lab successfully or not.
3. Sample output :

​

Completion and conclusion

1. In this lab, you created 4 IAM users & 2 IAM groups. At the time of the IAM groups creation, you attached the required IAM policies, added John and Sarah to the Dev Team group, and added Ted and Rita to the HR Team group.
2. You have learned how to create IAM users and groups.
3. You have learned how to add users to the respected IAM groups.
4. You have learned how to attach a policy while creating the IAM groups.
5. You have learned how to allow a specific user/group to access services and resources in your AWS account.
6. You have successfully validated the lab.

​

End lab

1. Sign out of AWS Account.
2. You have successfully completed the lab.
3. Once you have completed the steps click on End lab in the IP Lab Portal.

​

What gets checked

When you press Check my work, the platform verifies each of these:

• Create IAM Group — Check whether an IAM Group is created with IAM Users attached or not.
• Create IAM User — Check whether an IAM User is created or not.

​

Related help

• FAQs and Troubleshooting