> ## Documentation Index
> Fetch the complete documentation index at: https://cloud-architect.ipoint-labs.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Introduction to AWS Identity Access Management (IAM)
> Hands-on lab · 30m
Launch this lab in the IP Lab Portal, then follow the steps below in the AWS console.
Open IP Lab Portal
## Overview
### Lab details
1. This lab will cover the basics of AWS Identity and Access Management (IAM), which is a web service that helps the user securely control access to AWS resources. The motive of this lab is to walk the user through creating IAM users and adding them to IAM groups, along with permission policies, to provide access to various services in the AWS account.
2. Duration of the Lab: **30 Minutes**
3. AWS Region: **Global**
### Introduction
#### What is IAM?
* Stands for Identity and Access Management.
* IAM is a web service in AWS that helps manage user access to AWS resources.
* IAM allows you to create and manage AWS users and groups, and control their permissions to access AWS services.
* IAM provides a way to securely manage access to AWS resources, without having to share AWS account credentials.
* IAM is used to control who is authenticated and authorized to use AWS resources.
* The first identity in IAM is the root user, which has access to all AWS resources.
* The primary resources in IAM are users, groups, roles, policies, and identity providers.
* IAM roles are like IAM users, but they are intended to be assumed by anyone who needs them, and they do not have any credentials associated with them.
* IAM can be used from the AWS Management Console, AWS CLI, and AWS SDK.
### Architecture diagram
### Task Details
1. Sign into AWS Management Console.
2. Create IAM Users.
3. Create IAM Groups.
4. Validation of the lab
### Launching the lab environment
1. To launch the lab environment, click on the **Launch lab** button.
2. Please wait until the cloud environment is provisioned. It will take less than a minute to provision.
3. Once the Lab is started, you will be provided with **IAM username**, **Password**, **Access** **Key**, and **Secret** **Access** **Key**.
## Lab guide
### Lab steps
#### Task 1: Sign in to the AWS Management Console
1. Click on the **Open console** button, and you will get redirected to AWS Console in a new browser tab. You'll be automatically logged in to the AWS Console.
2. Once Signed In to the AWS Management Console, make the default AWS Region as **US East (N. Virginia) us-east-1.**
#### Task 2: Create IAM Users
In this task, we are going to create new IAM users by providing the name, password access, permissions, and tags. These users will be added to their respective groups in the next task.
1. Click on **Services** and select **IAM** under the **Security, Identity, & Compliance** section.
2. In the **IAM** dashboard, select the **IAM** **Users** option in the left panel and click on the **Create User** button to create a new IAM user.
3. In the **Add User** page, fill in the User Details section as follows:
* User name: Enter **John** (or the desired name for the user)
* **Check** the Provide user access to the AWS Management Console - optional checkbox
* Select **Custom password** under Console Password and Enter **whizlabs\@123** (or the desired password for the user)
* **Uncheck** the Users must create a new password at the next sign-in checkbox. (Recommended)
* Click on the **Next** button.
* In the **Set permissions** section, keep things as default. Click on the **Next** button.
* Scroll down and Under **Tags,** Click on the **Add new tag** button:
* Key: Enter ***Dev-Team***
* Value: Enter ***Developers***
* Click on the **Create User** button
* **Note:** Ignore the above error if it appears while creating Users and click on Close.
* Click on the **Return to users list** button and then on the **Continue** button.
* Repeat the same steps and tags for the IAM user by the name **Sarah**\*.\*
* Repeat the steps to create IAM users by the name ***Ted*** *and* ***Rita*** with the following details,
* Custom password: ***whizlabs\@123***
* Key: ***HR-Team***
* Value: ***HR***
* We have created **4 IAM** users.
#### Task 3: Create IAM Groups and add IAM Users
In this task, we are going to create new IAM groups and will add the users to their respective groups. Moreover, we will be adding permissions to the group so that users within the group have access to the services allocated to them using the permission policies.
1. Select the **User groups** in the left panel and click on the **Create group**
2. Set Group Name:
* User group name: Enter ***Dev-Team***
* Scroll down and select ***John*** and ***Sarah*** under **Add Users to the group**.
* Scroll down to the **Attach permissions Policies** section and search for **AmazonEC2ReadOnlyAccess** and **AmazonS3ReadOnlyAccess** policies. These policies provide read access for EC2 and S3 to the added users in the group.
* **Note: Do not add other policies than the ones mentioned above. You will get an error while creating a group**
* Review all details and click on the **Create group** button.
* Repeat the same steps to create an **HR-Team** group.
* Click on the **Create group**
* User group name: ***HR-Team***
* Scroll down and select ***Ted*** and ***Rita*** under **Add Users to the group**.
* Under **Attach permissions Policies**, select the **Billing** policy.
* **Note: Do not add other policies than the ones mentioned above. You will get an error while creating a group**
* Review all details and click on the **Create group** button.
**Do you know?**
In 2021, AWS IAM introduced a new feature called **Access Analyzer**, which uses automated reasoning to help identify the resources that an IAM policy allows or denies access to. This can be useful for identifying unintended access and for auditing IAM policies to ensure they conform to security best practices. Access Analyzer also provides recommendations for how to modify policies to remove unintended access, making it easier to maintain a secure AWS environment
#### Task 4: Validation Test
1. Once the lab steps are completed, please click the **Lab Validation** button on the left side panel. Click **Check my work** on the Lab Validation tab.
2. This will validate the resources in the AWS account and display whether you have completed this lab successfully or not.
3. Sample output :
### Completion and conclusion
1. In this lab, you created 4 IAM users & 2 IAM groups. At the time of the IAM groups creation, you attached the required IAM policies, added John and Sarah to the Dev Team group, and added Ted and Rita to the HR Team group.
2. You have learned how to create IAM users and groups.
3. You have learned how to add users to the respected IAM groups.
4. You have learned how to attach a policy while creating the IAM groups.
5. You have learned how to allow a specific user/group to access services and resources in your AWS account.
6. You have successfully validated the lab.
### End lab
1. Sign out of AWS Account.
2. You have successfully completed the lab.
3. Once you have completed the steps click on **End lab** in the IP Lab Portal.
## What gets checked
When you press **Check my work**, the platform verifies each of these:
* **Create IAM Group** — Check whether an IAM Group is created with IAM Users attached or not.
* **Create IAM User** — Check whether an IAM User is created or not.
## Related help
* [FAQs and Troubleshooting](/aws-cp/support/faqs-and-troubleshooting)