> ## Documentation Index > Fetch the complete documentation index at: https://cloud-architect.ipoint-labs.com/llms.txt > Use this file to discover all available pages before exploring further. # Creating IAM Policies > Hands-on lab · 30m Launch this lab in the IP Lab Portal, then follow the steps below in the AWS console. Open IP Lab Portal ## Overview ### Lab Details: 1. This lab walks you through the steps to Create IAM policies for different AWS services such as EC2, S3, and DynamoDB. 2. Duration: **30 minutes** 3. AWS Region: **US East (N. Virginia) us-east-1.** ### Introduction: #### What is AWS IAM Policy ? * AWS IAM (Identity and Access Management) policy is a security document that defines permissions for users, groups, roles, or AWS resources. It specifies what actions are allowed or denied on specific AWS services and resources, helping control access within an AWS environment. * IAM policies are written in JSON and outline permissions such as reading, writing, or managing AWS resources like S3 buckets, EC2 instances, or databases. By attaching policies to IAM identities or resources, AWS ensures secure access management and enforces the principle of least privilege. ### Architecture Diagram:

### Task Details: 1. Sign in to AWS Management Console 2. Create an IAM Policy for EC2. 3. Create an IAM Policy for S3. 4. Create an IAM Policy for DynamoDB. 5. Validation of the lab ### Launching the lab environment 1. To launch the lab environment, Click on the **Launch lab** button. 2. Please wait until the cloud environment is provisioned. It will take less than a minute to provision. 3. Once the Lab is started, you will be provided with **IAM username**, **Password**, **Access** **Key**, and **Secret** **Access** **Key**. You can only start one lab at any given time ## Lab guide ### Lab steps #### Task 1: Sign in to AWS Management Console 1. Click on the **Open console** button, and you will get redirected to AWS Console in a new browser tab. 2. On the AWS sign-in page, * Leave the Account ID as default. Never edit/remove the 12-digit Account ID present in the AWS Console. Otherwise, you cannot proceed with the lab. * Now copy your **Username** and **Password** in the Lab Console to the **IAM Username and Password** in AWS Console and click on the **Sign-in** button. 3. Once Signed In to the AWS Management Console, make the default AWS Region as **US East (N. Virginia) us-east-1.** If you face any issues, please go through [**FAQs and Troubleshooting**](/aws-cp/support/faqs-and-troubleshooting). #### Task 2: Creating an IAM Policy for EC2 In this task, we are going to create an IAM policy specifically for the EC2 (Elastic Compute Cloud) service. EC2 is a core AWS service that provides virtual servers in the cloud. By creating an IAM policy for EC2, users can define the permissions and actions that are allowed or restricted for EC2 resources. 1. Navigate to the **Services** menu at the top, then click on **IAM** in the **Security, identity, & Compliance** section. 2. In the left menu, select **Policies**. 3. Click on **Create Policy** button. 4. Under **Visual**, Type **EC2** in the search box and select **EC2**.

5. In the **Actions**, specify the actions allowed in EC2. For this service, We'll choose **read.** 6. Click on **Resources,** scroll down and choose **All resources** so that there is no need to specify the resource ARN.

7. Now scroll up and If you click on the JSON, you can see the policy we created.

8. Click on **Next** 9. Review: * Name : Enter **EC2Policy** * Description : Enter **EC2 Full Read access** * You can see the access level. * Review the policy and then click on **Create policy**.

10. After creating, you will get a verification for the created Policy.

11. In the fiter policies, type your policy name and click on it. 12. In the Summary, (under the JSON) you can see the policy you created.

#### Task 3: Creating an IAM Policy for S3 In this task, we are going to create an IAM policy for the S3 (Simple Storage Service) service. S3 is a scalable storage service provided by AWS. 1. Click on **Create Policy** button again. 2. Under **Visual Editor**, type S3 in the search box and select **S3**. 3. In the **Actions**, specify the actions allowed in S3. For this service, we'll choose **List, Tagging** and **Write**. 4. Click on **Resources** and choose **All resources** so that there is no need to specify the resource ARN.

5. If you click on the JSON, you can see the policy we created. 6. Click on **Next** button. 7. Review: * Name : Enter **S3Policy** * For **Policy description**, type a description for the new policy. * In the Summary, you can see the Access level. * Review the policy and then click on **Create Policy**. 8. After creating, you will get a verification for the created policy 9. In the filter policies, type your policy name and click on it. 10. In the Summary, (under the JSON) you can see the policy you created.

#### Task 4: Creating an IAM Policy for DynamoDB In this task, we are going to create an IAM policy for the DynamoDB service. DynamoDB is a fully managed NoSQL database service offered by AWS. 1. Click on **Create Policy** button again. 2. Under **Visual,** type **DynamoDB** in the search box and select **DynamoDB**. 3. In the **Actions**, specify the actions allowed in DynamoDB. For this service, we'll choose **All DynamoDB actions.** 4. Click on **Resources** and choose **All resources** so that there is no need to specify the resource ARN.

5. If you click on the **JSON** you can see the policy we created. 6. Click on **Next** button. 7. Review: * Name : Enter **DynamoDBPolicy** * For **Policy description**, type a description for the new policy. * In the Summary, you can see the Access level. * Review the policy and then click on **Create policy**. 8. After creating, you will get a verification for the created policy 9. In the filter policies, type your policy name and click on it. 10. In the Summary (under the JSON), you can see the policy you created. ?

**Do you know?** IAM policies are a powerful tool for managing access to AWS resources, and their default deny rule and support for conditions contribute to the robust security and access control capabilities of the AWS IAM system. #### Task 5: Validation Test 1. Once the lab steps are completed, please click on the **Check my work** button on the left side panel. 2. This will validate the resources in the AWS account and displays whether you have completed this lab successfully or not. 3. Sample output :

### Completion and conclusion 1. You have successfully created an IAM Policy for EC2 Service. 2. You have successfully created an IAM Policy for S3 Service. 3. You have successfully created an IAM Policy for DynamoDB service. ### End lab 1. Sign out of the AWS Account. 2. You have successfully completed the lab. 3. Once you have completed the steps, click on **End lab** in the IP Lab Portal. ## What gets checked When you press **Check my work**, the platform verifies each of these: * **Create IAM Policies** — Check whether IAM Policies are created or not. ## Related help * [FAQs and Troubleshooting](/aws-cp/support/faqs-and-troubleshooting)