WEBVTT

00:00.400 --> 00:03.820
-In this demo,
we will get introduced to the IAM service

00:03.900 --> 00:06.240
using the AWS management console.

00:06.980 --> 00:10.420
We will create users, group policies,

00:10.760 --> 00:15.040
create a custom IAM policy,
and finally create an IAM rule.

00:16.580 --> 00:20.720
To go to the IAM service
we can use the services tab on the top left

00:20.980 --> 00:24.120
and then navigate to the group
called security and compliance.

00:25.060 --> 00:28.820
The IAM service should be
the very first service listed under this group.

00:30.420 --> 00:33.580
What I need to leave,
we can also search for the IAM service

00:33.660 --> 00:35.880
from the service search bar on the dashboard.

00:37.260 --> 00:40.360
You will also notice that
when we are working with IAM,

00:40.440 --> 00:42.360
the region is set to global.

00:42.720 --> 00:48.060
This is because unlike other AWS services,
IAM is independent of the region.

00:48.860 --> 00:52.580
Once we create IAM objects
such as a user or a group,

00:52.720 --> 00:55.300
it will be available
in all regions and the account.

00:56.000 --> 00:58.660
We are now in the IAM dashboard.

00:59.380 --> 01:01.180
Since we just created this account,

01:01.340 --> 01:04.160
there are no users or groups
created at this point.

01:04.940 --> 01:09.180
Remember, right now we have logged
into the console using the root account.

01:10.240 --> 01:13.100
First, let's create an IAM user called Lucy.

01:14.000 --> 01:17.200
To do this, click on users
under the account management.

01:18.440 --> 01:20.780
Let's provide Lucy as the username.

01:21.840 --> 01:25.740
Now we have an option
to provide two types of access for the user.

01:26.480 --> 01:28.800
The first one is programmatic access,

01:28.880 --> 01:31.760
which creates an access key
and a secret access key.

01:32.360 --> 01:36.120
This allows the user to access AWS services,
programmatically,

01:36.580 --> 01:39.060
such as making use of the AWC ally.

01:40.040 --> 01:44.440
The other is access to the management console
with a username and a password.

01:45.400 --> 01:48.300
Neither of these methods
are an alternative for each other.

01:48.800 --> 01:52.620
You need management access
to log into the AWS management console

01:52.900 --> 01:55.960
and you need the access key ID
and the secret access key

01:56.060 --> 01:58.580
to be able to access AWS programmatically.

01:59.860 --> 02:04.740
Let's also provide a custom password
and allow password to be reset by the user.

02:06.080 --> 02:10.960
With this enabled, users will be
automatically attached to IAM policy

02:11.040 --> 02:13.460
that will allow them
to reset their own password.

02:15.220 --> 02:17.780
When ready, click on next permissions.

02:19.200 --> 02:23.080
We're not going to add any permission
at this moment so click on next.

02:24.220 --> 02:27.300
We now have an opportunity
to add tax for this user,

02:27.360 --> 02:29.760
but let's move forward and click on next.

02:31.340 --> 02:36.220
We can now review the details that we entered
and finally click on create user.

02:37.600 --> 02:39.500
Once the user has been created,

02:39.680 --> 02:44.220
we get the option to download the access key
and the secret access key folders user.

02:45.060 --> 02:48.180
This is the only time
where the secret access key is displayed

02:48.260 --> 02:49.700
with an option to download.

02:50.420 --> 02:54.260
Once we move past this stage,
we cannot see the secret access key again,

02:54.620 --> 02:56.280
and we will have to create a new one

02:56.360 --> 02:59.140
should we still need to access
AWS programmatically.

03:00.400 --> 03:04.000
Click on the download button
to save the key in a CSV file.

03:06.180 --> 03:09.340
As you can see, a user called Lucy
has now been created,

03:10.240 --> 03:13.060
but this user is not part of an IAM group yet.

03:14.540 --> 03:15.800
Let's click on the user.

03:16.680 --> 03:17.900
Under the permission staff,

03:17.980 --> 03:21.620
we can see that the policy
called IAM user change password

03:21.680 --> 03:23.620
is automatically attached to this user.

03:24.500 --> 03:29.540
To inspect what this policy does,
we can click on it and check out the GSN document.

03:31.600 --> 03:34.180
Let us now attach under the policy to this user.

03:34.980 --> 03:36.800
Since Lucy is the team lead

03:36.900 --> 03:40.140
and needs unrestricted access
to every service on this account,

03:40.400 --> 03:43.580
let's attach the administrator access policy
to this user.

03:44.340 --> 03:46.820
We select this policy and click next.

03:47.320 --> 03:50.940
Review the information provided
and click on add permissions.

03:52.440 --> 03:55.860
Lucy now has two policies
attached to her IAM user account.

03:57.000 --> 04:01.120
The administrator access policy
is perhaps the simplest decent document.

04:01.780 --> 04:05.440
It allows all actions
for every resource on the account

04:05.540 --> 04:07.180
as denoted by the star.

04:08.560 --> 04:10.740
Now let's create a few more users.

04:11.300 --> 04:15.540
Using the same process as before,
let's create another user called Abdul,

04:22.920 --> 04:25.260
but this time let's add him to a group.

04:25.940 --> 04:30.120
Since we do not have a group right now,
click on the create group button.

04:31.080 --> 04:33.880
Let's call the group projects sapphine users

04:34.000 --> 04:38.300
and to this group,
let's attach an Amazon EC2 full access policy.

04:46.440 --> 04:49.440
Click on next and let's add a tag this time

04:49.500 --> 04:53.960
with the key of name
and value of project sapphine users.

04:58.620 --> 05:00.980
As before, once the user has been created,

05:01.060 --> 05:04.060
we can download the access keys in a CSV file.

05:05.600 --> 05:07.660
Let's now add another user called Lee

05:08.240 --> 05:12.900
and this time, let's add him to the existing group
called project sapphine users.

05:30.060 --> 05:35.720
Both Abdul and Lee are now part of this IAM group
and now have full EC2 access.

05:36.980 --> 05:41.640
Let's add another policy to this group
which grants full access to the S3 service.

05:50.320 --> 05:53.180
Next, let's take a look at IAM policies.

05:54.260 --> 05:55.920
As we saw in the previous lecture,

05:56.200 --> 05:59.920
AWS provides hundreds
of mannies IAM policies by default

06:00.380 --> 06:02.900
such as the Amazon EC2 full access

06:03.000 --> 06:06.600
and the Amazon S3 full access policies
that we just used.

06:07.840 --> 06:10.660
There are also policies
for specific job functions

06:10.800 --> 06:13.860
such as the administrator access
and the billing policy.

06:15.660 --> 06:19.200
Let's now create
an easy to read only custom policy.

06:19.600 --> 06:23.240
To do this, click on the create policy button
on the top left.

06:24.160 --> 06:27.580
Next select a service
the policy is applicable for

06:27.960 --> 06:30.940
in this example,
let's select EC2 as the service.

06:32.080 --> 06:34.180
Next, choose the actions permitted.

06:34.740 --> 06:38.760
We want this policy to only allow
read analyst actions.

06:41.060 --> 06:44.880
We can also select which resources
this policy can be applied on

06:45.140 --> 06:48.040
such as a specific EC2 instance on the account.

06:49.580 --> 06:52.500
For this demo, let's click on all resources.

06:53.980 --> 06:57.060
Now click on review
and provide a name for this policy.

06:57.660 --> 07:00.700
Let's call it EC2-list-read.

07:01.680 --> 07:04.720
The policy will now be available
in the policy list.

07:10.000 --> 07:11.980
We can review the GSN document

07:12.060 --> 07:17.420
and see that it allows all actions
of list and read on all EC2 resources.

07:18.360 --> 07:21.740
This policy can now be attached
to users, groups, or rules.

07:25.980 --> 07:28.260
Similarly, let's create another policy

07:28.340 --> 07:32.080
that allows all read analyst actions
for S3 service.

07:48.020 --> 07:50.820
Let's call it the S3 read only policy.

08:02.620 --> 08:06.160
Once created a quick inspection
of the GSN document

08:06.220 --> 08:11.380
shows that this policy allows
all read analyst actions on all S3 resources.

08:15.880 --> 08:17.680
Let's now move on to rules.

08:18.060 --> 08:22.900
In the previous lecture, we saw that rules
can be used for a number of different use cases.

08:23.540 --> 08:27.700
We can use them to allow access
to users from a different AWS account.

08:28.060 --> 08:30.700
We can also grant permissions to services,

08:30.800 --> 08:33.760
to access other services
within the same AWS account.

08:35.020 --> 08:37.800
Let's create a rule for this use case now.

08:38.840 --> 08:41.940
Click on rules
and click on the create rule button.

08:43.480 --> 08:46.720
First, we need to select the type
of the trusted entity.

08:47.400 --> 08:50.540
This could be a service
or another AWS account

08:50.820 --> 08:53.600
or the organization's
corporate directory for example.

08:54.460 --> 08:59.820
We want this rule to grant EC2 instances
read only access to the S3 service.

09:00.220 --> 09:07.180
Let's select AWS service as the trusted entity
and within this, select EC2 as the service.

09:08.580 --> 09:12.220
Click on next and now we can attach
a policy to this rule.

09:12.840 --> 09:16.780
Let's attach the customer is through
read only policy that we just created.

09:18.860 --> 09:20.860
Let's also add an appropriate tag.

09:21.320 --> 09:26.300
Here we are providing a value
of S3 read only role for EC2instances,

09:26.980 --> 09:29.800
click on next
and review the options that we provided.

09:30.680 --> 09:33.420
Let's call the role S3 read only role

09:33.800 --> 09:36.060
and awfully let's also update the description.

09:37.020 --> 09:39.740
When ready, click on the create role button.

09:41.220 --> 09:45.940
The role is now available for use
and can be attached to an EC2 instance.

09:46.700 --> 09:49.240
That's it for this demo in the next lecture,

09:49.340 --> 09:53.080
we will see how to use Terraform
to work with IAM service.