Accessing S3 with AWS IAM Roles

​

Overview

1. This lab walks you through the steps to create an AWS S3 bucket and demonstrates how to access the bucket using AWS CLI commands from EC2 instance and IAM roles.
2. Duration: 30 minutes
3. AWS Region: US East (N. Virginia) us-east-1

​

Introduction

IAM Policy:

1. An IAM (Identity and access management) policy is an entity in AWS, that enables you to manage access to AWS services and resources in a secure fashion.
2. Policies are stored on AWS in JSON format and are attached to resources as identity-based policies.
3. You can attach an IAM policy to different entities such as an IAM group, user, or role.
4. IAM policies gives us the power of restricting users or groups to only use the specific services that they need.

Policy Types:

• Identity-Based-Policies
• Resource-Based-Policies

Identity-Based-Policy

1. Identity-based policies are policies that you can attach to an AWS identity (such as a user, group of users, or role).
2. These policies control what actions an entity can perform, which resources they can use, and the conditions in which they can use said resources.
3. Identity-based policies are further classified as:

• AWS Managed Policies
• Custom Managed Policies

AWS Managed Policies

1. AWS Managed policies are those policies that are created and managed by AWS itself.
2. If you are new to IAM policies, you can start with AWS managed policies before managing your own.

Custom Managed Policies

1. Custom managed policies are policies that are created and managed by you in your AWS account.
2. Customer managed policies provide us with more precise control than AWS managed policies.
3. You can create and edit an IAM policy in the visual editor or by creating the JSON policy document directly.
4. You can create your own IAM policy using the following link: https://awspolicygen.s3.amazonaws.com/policygen.html

Resource-Based-Policy

1. Resource-based policies are policies that we attach to a resource such as an Amazon S3 bucket.
2. Resource-based policies grant the specified permission to perform specific actions on particular resources and define under what conditions these policies apply to them.
3. Resource-based policies are in line with other policies.
4. There are currently no AWS-managed resource-based policies.
5. There is only one type of resource-based policy called a trust policy, which is attached to an IAM role.
6. An IAM role is both an identity and a resource that supports resource-based policies.

IAM Role

1. An IAM role is an AWS IAM identity (that we can create in our AWS account) that has specific permissions.
2. It is similar to an IAM user, which determines what the identity can and cannot do in AWS.
3. Instead of attaching a role to a particular user or group, it can be attached to anyone who needs it.
4. The advantage of having a role is that we do not have standard long-term credentials such as a password or access keys associated with it.
5. When resources assume a particular role, it provides us with temporary security credentials for our role session.
6. We can use roles to access users, applications, or services that don’t have access to our AWS resources.
7. We can attach one or more policies with roles, depending on our requirements.
8. For example, we can create a role with s3 full access and attach it to an EC2 instance to access S3 buckets.

Simple storage service(S3)

1. Amazon S3 is a simple storage service that we can use to store and retrieve any amount of data, at any time, from anywhere on the web.
2. It gives developers and users access to highly scalable, reliable, fast, inexpensive data storage infrastructure.
3. S3 guarantees 99.9% availability at any point in time.
4. S3 has been designed to store up to 5 TB of data.
5. S3 is global, meaning you can create a bucket in any region and access it from anywhere. Due to this, the name of the bucket should be a unique one.
6. The S3 bucket objects, as well as the bucket, can be deleted at any time by the user.
7. We can limit access to our bucket by granting different permissions for different users.
8. S3 also comes with additional features such as versioning, static website hosting, server access logging and life cycle policy for storing objects, eand many others.

​

Architecture diagram

​

Task details

1. Sign in to AWS Management Console
2. Create an IAM Role and policy for EC2 Instance
3. Launch an EC2 instance
4. Viewing the S3 bucket
5. Access the S3 bucket via EC2 instance.
6. Validation of the lab

​

Launching the lab environment

1. To launch the lab environment, Click on the Launch lab button.
2. Please wait until the cloud environment is provisioned. It will take less than a minute to provision.
3. Once the Lab is started, you will be provided with IAM user name, Password, Access Key, and Secret Access Key.

​

Lab guide

​

Lab steps

​

Task 1: Sign in to AWS Management Console

1. Click on the Open console button, and you will get redirected to AWS Console in a new browser tab.
2. On the AWS sign-in page,
   • Leave the Account ID as default. Never edit/remove the 12 digit Account ID present in the AWS Console. otherwise, you cannot proceed with the lab.
   • Now copy your User Name and Password in the Lab Console to the IAM Username and Password in AWS Console and click on the Sign in button.
3. Once Signed In to the AWS Management Console, Make the default AWS Region as US East (N. Virginia) us-east-1.

​

Task 2: Create an IAM Role and attach policy to it for EC2 Instance

1. Navigate to the Services menu at the top, then click on IAM in the Security, identity, & Compliance section.
2. Navigate to Roles from the left navigation menu.
3. Click on Create Role button.

4. In Select trusted entity: choose AWS Service

5. Under the use case click on the drop-down button to search the Ec2 and then Choose Allows Ec2 instances to call AWS services on your behalf and then click on Next.

6. In the Permissions policies section click the search bar type AmazonS3ReadOnlyAccess, select the checkbox next to the policy name, and then click the Next button

7. Under Review: Enter EC2Role in the Role Name.
8. Click on Create role button.

​

Task 3: Launching EC2 Instance

1. Make sure you are in the US East (N. Virginia) us-east-1 Region.
2. Navigate to Services menu in the top, then click on EC2 in the Compute section.
3. Click on Instances from the left side bar and then click on Launch instances button.
4. Name : Enter S3EC2server

5. For Amazon Machine Image (AMI): Choose Amazon Linux 2023 kernel-6.1 AMI.

6. For Instance Type: select t2.micro

7. For Key pair: Select Create a new key pair Button

• Key pair name: WhizKey
• Key pair type: RSA
• Private key file format: .pem

8. Select Create key pair Button.

9. In Network Settings Click on Edit button:

• Auto-assign public IP: Enable
• Select Create new Security group
• Security group name : Enter S3server-SG
• Description : Enter Security Group to allow traffic to EC2
• To add SSH
  1. Choose Type: Select SSH
  2. Source: Select Anywhere

10. Click on Advanced details.
11. In IAM instance Profile : Select EC2Role which we have created in Task 2.
12. Keep Rest thing Default and Click on Launch Instance Button.
13. Select View all Instances to View Instance you Created
14. Launch Status: Your instances are now launching, Navigate to Instances page from left menu and wait the status of the EC2 Instance changes to running.
15. You can tell that the instance is running by checking the instance status (example below).

16. Select the instance and copy the Public IPv4 address and save it in any text editor.

​

Task 4: Viewing the S3 Bucket

1. Navigate to the Services menu at the top. Click on S3 in the Storage section.
2. You can see a bucket with a name similar to whizlabs<RANDOM-NUMBERS>.

​

Task 5: Accessing the S3 bucket via EC2 Instance

1. To SSH into the server, please follow the steps in SSH into EC2 Instance.
2. Once logged in, switch to the root user:
   sudo su
   
3. Run the below command to find your S3 bucket via CLI.
   aws s3 ls
   
4. You will see output similar to the image below, which shows that we are able to access the S3 bucket with the help of role attached to the EC2 instance.
5. Create a new text file and upload it to the bucket via AWS CLI (using the following set of commands):
   touch test.txt
   
   aws s3 mv test.txt s3://<your_bucket_name>
   

6. Check for the new file in the S3 bucket.

7. Repeat step 5 and create some more files like new.txt, smile.txt and upload it to the S3 bucket using below commands:

touch new.txt smile.txt

aws s3 mv new.txt s3://<your_bucket_name>

aws s3 mv smile.txt s3://<your_bucket_name>

8. You can confirm the files uploaded to S3 bucket by navigating to the bucket in the AWS console.

9. You can also list the files uploaded to S3 bucket via CLI from the EC2 instance with the following command:
   aws s3 ls s3://<your_bucket_name>
   

​

Task 6: Validation Test

1. Once the lab steps are completed, please click on the Check my work button on the right side panel.
2. This will validate the resources in the AWS account and displays whether you have completed this lab successfully or not.
3. Sample output :

​

Completion and conclusion

1. You have successfully created an IAM role to access S3 by granting S3 full access.
2. You have created an EC2 instance with an IAM role attached.
3. You have uploaded a file to an S3 bucket via CLI from the EC2 instance.
4. You have uploaded a file to an S3 bucket from the AWS console.

​

End lab

1. Sign out of AWS Account.
2. You have successfully completed the lab.
3. Once you have completed the steps, click on End lab in the IP Lab Portal.

​

What gets checked

• Check IAM Role Attached to EC2 — Check whether an IAM role is attached to the EC2 instance.
• Create an AWS S3 Bucket with Policy — Check whether S3 bucket is created and bucket policy added or not
• check s3 object — Check whether an object is uploaded to the S3 bucket.
• Launch an EC2 Instance — Check whether an EC2 Instance is launched or not.

​

Related help

• FAQs and Troubleshooting
• SSH into EC2 Instance