Creating IAM Roles

Launch this lab in the IP Lab Portal, then follow the steps below in the AWS console. Open IP Lab Portal

​

Overview

​

Lab Details:

1. This lab walks you through the steps to Create IAM Roles.
2. Duration: 30 minutes
3. AWS Region: US East (N. Virginia) us-east-1

​

Introduction :

​

What is AWS IAM role ?

AWS IAM (Identity and Access Management) role is a security feature provided by Amazon Web Services (AWS) that enables you to manage access to AWS services and resources securely. IAM roles are used to delegate permissions to entities within your AWS environment, such as users, services, or applications, instead of using long-term access keys like usernames and passwords.

• IAM roles define a set of permissions that determine what actions can be performed on AWS resources. These permissions can be associated with AWS services, such as EC2 instances, Lambda functions, or S3 buckets, as well as with other AWS accounts. By assigning roles to entities, you can control their level of access and limit the need for sharing credentials. IAM roles have several advantages over using access keys:
• Temporary credentials: IAM roles provide temporary security credentials that can be assumed by entities. These credentials have an expiration time, reducing the risk of unauthorized access.
• Least privilege access: You can assign fine-grained permissions to IAM roles, granting only the necessary access required for a specific task or service. This principle of least privilege enhances security by minimizing potential damage if credentials are compromised.
• Flexibility: IAM roles can be easily associated with multiple entities, allowing for centralized access management and reducing administrative overhead.
• Trust relationships: IAM roles can establish trust relationships with other AWS accounts or services, enabling cross-account or cross-service access. This is useful when you need to grant permissions to external entities or to enable services to access resources on your behalf.

​

Architecture Diagram:

​

Task Details:

1. Sign in to AWS Management Console
2. Create an IAM Role for EC2 service
3. Create an IAM Role for DynamoDB service.
4. Validation of the lab

​

Launching the lab environment

1. To launch the lab environment, Click on the Launch lab button.
2. Please wait until the cloud environment is provisioned. It will take less than a minute to provision.
3. Once the Lab is started, you will be provided with IAM user name, Password, Access Key, and Secret Access Key.

​

Lab guide

​

Lab steps

​

Task 1: Sign in to AWS Management Console

1. Click on the Open console button, and you will get redirected to AWS Console in a new browser tab.
2. On the AWS sign-in page,
   • Leave the Account ID as default. Never edit/remove the 12 digit Account ID present in the AWS Console. otherwise, you cannot proceed with the lab.
   • Now copy your User Name and Password in the Lab Console to the IAM Username and Password in AWS Console and click on the Sign in button.
3. Once Signed In to the AWS Management Console, Make the default AWS Region as US East (N. Virginia) us-east-1.

​

Task 2: Creating Role for an EC2 Service

1. Navigate to IAM by clicking on the Services menu at the top, then click on IAM in the Security, identity, & Compliance section.
2. In the left menu, select Roles.
3. Click on Create Role button.
4. EC2 should be selected as the type of trusted entity under Use Case. Then click on Next button.
5. In Attach permissions policies**,** type EC2 in the Filter Policies and select AmazonEC2FullAccess.

   Note: Do not add other policies than the mentioned above. You will get an error while creating the Role.

6. Then click on Next button
7. Review :
   • Role Name : Enter EC2Role
   • Review the role and then choose Create role button.
8. After creating, you will get a verification for the created Role.
9. When searching for our role name, you will see the created role populate.

• When you set up an AWS service environment, you must define a role for the service to assume. You can attach this Role to the AWS services. This service role must include all the permissions required for the service to access the AWS resources that it needs.
• This allows EC2 to perform actions on our behalf.

​

Task 3: Creating Role for an AWS Service - DynamoDB

1. In the left menu, select Roles.
2. Click on Create Role button.
3. DynamoDB should be selected as the type of trusted entity under Use Case.
4. Select the Use case as Amazon DynamoDB Accelerator (DAX) - DynamoDB access.

5. Then, click on Next button.
6. In Attach permissions policies**,** you can see AmazonDynamoDBFullAccess.

7. Then, click on Next button.
8. Review :
   • Role Name : Enter DynamoDBRole
   • Review the role and then choose Create role button.
9. After creating, you will get a verification for the created Role.
10. When searching for our role name, you will see the created role populate.
11. When you set up an AWS service environment, you must define a role for the service to assume.You can attach this Role to the AWS services. This service role must include all the permissions required for the service to access the AWS resources that it needs.
12. This allows DynamoDB to perform actions on our behalf.

​

Do you know ?

An IAM role is an IAM identity that you can create in your account that has specific permissions. An IAM role is similar to an IAM user, in that it is an AWS identity with permission policies that determine what the identity can and cannot do in AWS. However, instead of being uniquely associated with one person, a role is intended to be assumable by anyone who needs it.

​

Task 4: Validation Test

1. Once the lab steps are completed, please click on the Check my work button on the right side panel.
2. This will validate the resources in the AWS account and shows you whether you have completed this lab successfully or not.
3. Sample output :

​

Completion and conclusion

1. You have successfully created an IAM Role for EC2 Service.
2. You have successfully created an IAM Role for DynamoDB service.

​

End lab

1. Sign out of the AWS Account.
2. You have successfully completed the lab.
3. Once you have completed the steps click on End lab in the IP Lab Portal.

​

What gets checked

When you press Check my work, the platform verifies each of these:

• Create Custom IAM Role — Check whether a Custom IAM Role is created and attached with custom policies or not.

​

Related help

• FAQs and Troubleshooting