IAM AWS Project
Hello everyone! Today, I am going to be completing a project that involves providing IAM to EC2 instances. I went ahead and created 2 EC2 instances for this project.
I also went ahead and gave each of my instances unique tags to help differentiate between production and development environments. These tags will also be used later on when provisioning access to resources via IAM policy.
Now, I am going to create my IAM policy. In this step, I will give our new intern access to the development instance but not the production instance. This is because we don’t want our new intern to accidentally mess with the production environment. To start, I’m going to head to the IAM dashboard.
Next, I’m going to choose Policy in the sidebar and select “Create policy”.
I used the JSON policy editor to create the policy.
This allows the starting, stopping, and describing of EC2 instances tagged with “Env = development” while denying the ability to do so for instances outside the development environment. Now, I went ahead and named the policy and created it.
Get Dh’s stories in your inbox
Join Medium for free to get updates from this writer.
In this step, I will create an Account Alias because it simplifies user login into AWS. To do so, I will select the Dashboard option on the left panel in the IAM console and choose Create under Account Alias. I gave my preferred alias name; this allows for easier access, as the URL isn’t as complicated or long. In this next part of the project, I will create IAM users to provide access to my AWS console without my credentials. I will also create an IAM group to centrally manage permissions for all interns in one place. I went ahead and created a group by attaching the IAM policy I created earlier in the project.
Now I’m going to create users to put in the group. I selected IAM users on the left panel and selected to create a user. From there, I entered the name and other details.
Next, I added the user to the policy I created earlier and created the user.
Now, with the user created, I’m going to log in as the user and test their permissions before giving them access to ensure their permissions are provisioned correctly. It already looks promising.
Now we’re going to attempt to try and stop the production EC2 instance to see if the intern has their permissions over-provisioned.
The intern is unable to stop the production instance, just like I wanted. Next, we will see if the intern can stop the development instance.
That worked just as intended. That will complete this project.
