Creating IAM Policies

Launch this lab in the IP Lab Portal, then follow the steps below in the AWS console. Open IP Lab Portal

​

Overview

​

Lab Details:

1. This lab walks you through the steps to Create IAM policies for different AWS services such as EC2, S3, and DynamoDB.
2. Duration: 30 minutes
3. AWS Region: US East (N. Virginia) us-east-1.

​

Introduction:

​

What is AWS IAM Policy ?

• AWS IAM (Identity and Access Management) policy is a security document that defines permissions for users, groups, roles, or AWS resources. It specifies what actions are allowed or denied on specific AWS services and resources, helping control access within an AWS environment.
• IAM policies are written in JSON and outline permissions such as reading, writing, or managing AWS resources like S3 buckets, EC2 instances, or databases. By attaching policies to IAM identities or resources, AWS ensures secure access management and enforces the principle of least privilege.

​

Architecture Diagram:

​

Task Details:

1. Sign in to AWS Management Console
2. Create an IAM Policy for EC2.
3. Create an IAM Policy for S3.
4. Create an IAM Policy for DynamoDB.
5. Validation of the lab

​

Launching the lab environment

1. To launch the lab environment, Click on the Launch lab button.
2. Please wait until the cloud environment is provisioned. It will take less than a minute to provision.
3. Once the Lab is started, you will be provided with IAM username, Password, Access Key, and Secret Access Key.

​

Lab guide

​

Lab steps

​

Task 1: Sign in to AWS Management Console

1. Click on the Open console button, and you will get redirected to AWS Console in a new browser tab.
2. On the AWS sign-in page,
   • Leave the Account ID as default. Never edit/remove the 12-digit Account ID present in the AWS Console. Otherwise, you cannot proceed with the lab.
   • Now copy your Username and Password in the Lab Console to the IAM Username and Password in AWS Console and click on the Sign-in button.
3. Once Signed In to the AWS Management Console, make the default AWS Region as US East (N. Virginia) us-east-1.

​

Task 2: Creating an IAM Policy for EC2

In this task, we are going to create an IAM policy specifically for the EC2 (Elastic Compute Cloud) service. EC2 is a core AWS service that provides virtual servers in the cloud. By creating an IAM policy for EC2, users can define the permissions and actions that are allowed or restricted for EC2 resources.

1. Navigate to the Services menu at the top, then click on IAM in the Security, identity, & Compliance section.
2. In the left menu, select Policies.
3. Click on Create Policy button.
4. Under Visual, Type EC2 in the search box and select EC2.

5. In the Actions, specify the actions allowed in EC2. For this service, We’ll choose read.
6. Click on Resources, scroll down and choose All resources so that there is no need to specify the resource ARN.

7. Now scroll up and If you click on the JSON, you can see the policy we created.

8. Click on Next
9. Review:
   • Name : Enter EC2Policy
   • Description : Enter EC2 Full Read access
   • You can see the access level.
   • Review the policy and then click on Create policy.

10. After creating, you will get a verification for the created Policy.

11. In the fiter policies, type your policy name and click on it.
12. In the Summary, (under the JSON) you can see the policy you created.

​

Task 3: Creating an IAM Policy for S3

In this task, we are going to create an IAM policy for the S3 (Simple Storage Service) service. S3 is a scalable storage service provided by AWS.

1. Click on Create Policy button again.
2. Under Visual Editor, type S3 in the search box and select S3.
3. In the Actions, specify the actions allowed in S3. For this service, we’ll choose List, Tagging and Write.
4. Click on Resources and choose All resources so that there is no need to specify the resource ARN.

5. If you click on the JSON, you can see the policy we created.
6. Click on Next button.
7. Review:
   • Name : Enter S3Policy
   • For Policy description, type a description for the new policy.
   • In the Summary, you can see the Access level.
   • Review the policy and then click on Create Policy.
8. After creating, you will get a verification for the created policy
9. In the filter policies, type your policy name and click on it.
10. In the Summary, (under the JSON) you can see the policy you created.

​

Task 4: Creating an IAM Policy for DynamoDB

In this task, we are going to create an IAM policy for the DynamoDB service. DynamoDB is a fully managed NoSQL database service offered by AWS.

1. Click on Create Policy button again.
2. Under Visual, type DynamoDB in the search box and select DynamoDB.
3. In the Actions, specify the actions allowed in DynamoDB. For this service, we’ll choose All DynamoDB actions.
4. Click on Resources and choose All resources so that there is no need to specify the resource ARN.

5. If you click on the JSON you can see the policy we created.
6. Click on Next button.
7. Review:
   • Name : Enter DynamoDBPolicy
   • For Policy description, type a description for the new policy.
   • In the Summary, you can see the Access level.
   • Review the policy and then click on Create policy.
8. After creating, you will get a verification for the created policy
9. In the filter policies, type your policy name and click on it.
10. In the Summary (under the JSON), you can see the policy you created.

?

​

Task 5: Validation Test

1. Once the lab steps are completed, please click on the Check my work button on the left side panel.
2. This will validate the resources in the AWS account and displays whether you have completed this lab successfully or not.
3. Sample output :

​

Completion and conclusion

1. You have successfully created an IAM Policy for EC2 Service.
2. You have successfully created an IAM Policy for S3 Service.
3. You have successfully created an IAM Policy for DynamoDB service.

​

End lab

1. Sign out of the AWS Account.
2. You have successfully completed the lab.
3. Once you have completed the steps, click on End lab in the IP Lab Portal.

​

What gets checked

When you press Check my work, the platform verifies each of these:

• Create IAM Policies — Check whether IAM Policies are created or not.

​

Related help

• FAQs and Troubleshooting