Okay. So let's practice using IAM roles
for our EC2 Instance.
So at first, I'm going to connect to my EC2 Instance.
You can SSH, or you can use EC2 Instance Connect
if you wanted to.
I will use EC2 Instance Connect
because it's just going to be in my web browser
and a little bit simpler.
So back into my instance
with EC2 Instance Connect right here.
And we are in our Instance.
So as we can see,
we are ec2-user@ and the private IP.
So regardless if you're using EC2 Instance Connects
or SSH through your terminal, or whatever,
through PuTTY.
Then if you see this, we are at the same stage, okay?
So now you can just do some Linux commands.
For example, ping Google,
and you can get some information out of Google.
And I will do Control + C to go out of it
or issue any kind of Linux commands you want.
Okay, you don't need to know the next command
going into the exam,
but this is just a Linux terminal available
to you right now in the cloud.
So we'll type clear to clear the screen
and next we have to run some IAM commands.
So the cool thing is that's the Amazon Linux AMI
we're using right now comes with the aid of a CLI.
And so, as you can see, it is installed.
So what we can do is start using some commands.
For example, aws iam list users.
And if we do so, it says unable to look at credentials.
You can configure credentials by using aws configure.
So we could indeed run aws configure
to configure the credentials and specify an Access ID
a Secret Access key, and a region name.
But this is a really, really, really bad idea.
And the reason is that if we run aws configure
and enter our personal details onto this EC2 Instance,
then anyone else in our accounts
could again connect to our EC2 Instance.
For example, using EC2 Instance Connect
and retrieve the value of these credentials in our instance,
which is not what we want.
This is something that's really, really bad.
And so as a rule of thumb, never, ever, ever
enter your IAM APA key.
So the Access Key ID and the Secret Access key
into an EC2 Instance.
This is horrible and if you see someone doing it,
please show them this video.
Instead, what we have to do is use IAM rules.
So if you remember,
when we were in the management console and we were in IAM,
we had created an IAM role.
So let's go back into the Roles.
We had this demo role for EC2
that had one policy attached called IAMReadOnlyAccess.
So we are going to attach this role
onto our EC2 Instance to provide it with credentials.
Okay, so how do we do this?
For this, we can go into Security.
And as you can see,
there is no IAM Role right now onto our instance.
So what we can do is go back to our Instances,
Action, Security, and then Modify IAM role.
Here we have to choose an IAM role.
So we have DemoRoleForEC2 and click on Save
to attach this IAM role into our Instance.
So if you go back to Security,
now the IAM role attached to Instance
DemoRoleForEC2.
So the effect of this is that now
if we do aws iam list users and press Enter,
where we are getting a response around the users from IAM.
So as we can see, we did not run the command aws configure.
We just attached an IAM role and ran this command.
And it works.
And as a proof, if we go into this role
and detach this permission, so now it's gone,
and run the command again, we're getting an access denied.
So the role is really linked now to the EC2 Instance.
And this is how we provide AWS credentials
to our EC2 Instances only,
only through IAM roles, okay?
So if we go back to IAM
and we attach a policy to this role
and go back to IAMReadOnlyAccess,
attach this policy and then rerun the command,
we get an access denied
because sometimes it can take a little bit of time
to propagate the changes from IAM into AWS.
But if we run it one more time,
we're getting the output we expect,
which is what we want.
So this is very important
for you to understand this,
use IAM roles for your EC2 Instances.
So this is hopefully good for you.
I hope you like this hands-on
and I will see you in the next lecture.