Welcome back to backspace Academy. In this lab on IAM we're going to run 2
through some of the main features of I am will create a user will create a 3
group and we'll add that user to that group will create a password policy 4
we'll set up an IAM role for ec2 instances will create an account alias 5
which will make life easier for us to log into our account and finally we'll 6
create a credentials report which will list all of the credentials that we've 7
got for this account and the activity of those okay so we start off at services 8
and IAM and we go to users now we want to add a user we give that user a name 9
and we're going to give this user both programmatic access and programmatic 10
access means that they can use the command-line interface or the software 11
development kits with an access key and a secret access key and we're also going 12
to give this person console access as well so they can log into the management 13
console we'll use an auto-generated password and we'll require that they 14
have a password reset when they first log in click on next permissions now 15
because we're going to be creating a group which will have those permissions 16
and when this user will be added to that group they will inherit the permissions 17
of the group so we don't need to define the permissions at the user level so 18
we're just going to click on next review and we can see there that we've got the 19
username as test user and they got both programmatic and a console access 20
auto-generated password and they require a password reset and they're also got 21
permission to change their own user password because by default they don't 22
have that but because we selected the option that they have to change their 23
password then that automatically attaches that policy for us so we click 24
on create user 25
okay so the user has now been created so what we've got now are the credentials 26
for the user so the users name is test user now for programmatic access and for 27
command line interface access we need the access key ID and the secret access 28
key which is what we've got there and then we've got the password which is 29
what we use combined with the username to log into the console so we can send 30
an email to someone with that or we can download those credentials here as well 31
and so if we download this CSV but we need to do one of the other because once 32
we click on close we can't get this information again so we need to get this 33
information now so either download this CSV or send an email I'd probably 34
recommend you download the CSV and that will have all of the important 35
information on there and it'll also have this sign-in URL as well so we just 36
click on that, I'm going to download that now, and I'm just going to now that I've 37
downloaded that I'll close it, okay so there's our user that has been set up 38
for us okay so now that we've created a user I'm going to create a group now and 39
we're going to associate a policy to that group and that will have 40
permissions for anyone that enters that group and then we're going to get our 41
user and we're going to put that user inside of that group and then that user 42
will inherit the permissions of that group so let's click on groups create a 43
new group I'm going to call this administrators we'll click on next step 44
so now we need to attach a policy so we can create our own policy or we can get 45
one ready made which is what we would normally do so there's one just here 46
administrator access that will be fine for us for administrators we'll click on 47
next step so we can see there that we've got our group called administrators and 48
we've got the policy that is going to be attached to it for administrator access 49
we'll click create group okay so that group has been created down 50
so what we can do now is we can select that group we go to group actions and we 51
can add users to that group so we select our test user and we add that user to 52
our group so now when we click on that group we'll just go back to groups again 53
so we can click on this group and we can see here the users for that group our 54
test user and the permissions is administrator access so now our test 55
user previously had no access and now they've got administrator access okay so 56
now that we've got our user in a group what we'll do is we'll we'll look at the 57
password policy with that we're set up for that user so again we'll go to users 58
and more select our test user just click on the name there and we're going to go 59
to security credentials and there we can see that we've got the part the console 60
password and we can manage our password here so console access is enabled and 61
we're going to keep the existing password or use an auto-generated 62
password will use an auto-generated password require a password reset and 63
we'll put that in there as well and so then we at the time we can actually 64
change the individual password policy for a user as such and so when they 65
first log in they're going to have to have an auto-generated password and 66
they're going to have to require a password reset so I'm doing click on 67
apply, so now we can download the CSV file for that and that will have the 68
login details for that, so we'll just download that and that will have the new 69
password that has been auto-generated for this user so we can also manage 70
passwords at the account level as well so what we can do is we can go to 71
account settings over here and we can manage our account password policy from 72
here and so here we can see we've got a number of options so we can require 73
least one uppercase letter one lower case letter at least one number allow 74
users to change your own password we can put in password expiration time so every 75
wanted one of the password to expire in say 90 days we can put that in there so 76
there's a lot of things that we can set up for a password policy and that will 77
be applied to all users of of the account and so we just click on apply 78
password policy for that and so that's been done there for us okay so now that 79
we've created users and groups and we've looked after passwords and password 80
policies and all that what we'll look at now is having roles for ec2 instances so 81
if we've got an application running on ec2 and we want that application to 82
access resources within our AWS account we need to allow that to happen so if at 83
once if we want our our ec2 server to for example access to a bucket then we 84
can create an IAM role that can allow that to happen if we want our ec2 server 85
to read cloudwatch logs for example then we can set that up as well so what 86
we'll do is we'll create an ec2 role now so we go to roles and he can see it this 87
tells you what our role is all about and it's not only for ec2 but we can use it 88
for IAM users in another AWS account - to access our account we can use it for 89
federated identity through for example logging in with Google or Facebook or 90
with enterprise SAML application all this sort of stuff but for now we just 91
use it for an ec2 instance so we click on click create role so we're going to 92
choose we're going to use an AWS service and we're going to choose the ec2 93
service and that will allow our ec2 instances to call AWS services on our 94
behalf so we'll just select that and then we go to permissions so again we 95
need to attach a policy for this role just the same as we attached a policy 96
for our group before we need to do this for this one here so I'm just going to 97
search for ec2 98
okay so this one down the bottom here which is cloudwatch-actions ec2 access 99
we'll select that one and so that will provide read-only access to cloud watch 100
alarms and metrics okay so we click on next review will give that a name we 101
won't worry about giving it a description there's one there that's 102
quite okay and we can see there that we've got that password or that sorry 103
that policy attached to that which is cloud watch actions for ec2 and will 104
click on create role okay so I've already got a role here before 105
just ignore that one but here is the role that we just created so we can 106
click on that and have a look at it so there we can see we've got our our 107
policy on them and we've also got an ARN for this role but we won't worry too 108
much about that, so that's all been done and looking pretty good, so what we can 109
do now is that we can look at creating an account alias so if we go to the 110
dashboard and we can see here we've got the the sign-in link and you can see 111
it's quite difficult to remember the signin.aws.amazon.com/console 112
is reasonably easy to remember but remembering the big long account number 113
is not so good so what we can do is we can click on customize and we can give 114
that account an alias 115
okay so I'm just going to call mine backspace - labs but please don't call 116
yours backspace call it something else that's unique for you and I just 117
click on yes create and there you can see now the sign-in link is backspace - labs 118
.sign in AWS and so that's a lot easier for for you to remember okay so 119
the last thing I want to do is show you how to get a credentials report now 120
that's quite a handy thing to know all of the credentials that you've got out 121
of there and whether they're being used or not if you've got a large 122
organization you want to be able to know that those credentials are being used 123
and if they're not then get rid of them so you can go to credentials report and 124
then click on download report and that credentials report will will download so 125
when you open that up okay so you'll see here that we've got the the user so we 126
got our root account access and we've got our test user that we created 127
they've got an ARN or Amazon resource name and the user is created on this 128
date and we've got password enabled and we can see here we've got 129
multi-factor authentication active which we don't, but in the next lab we're going 130
to have a look at that creating multi-factor or implementing 131
multi-factor authentication and so it gives you a lot of information there 132
around what is going on with your with your credentials so that's a handy thing 133
to have so that finishes up for this IAM lab coming up next we'll have a look at 134
implementing multi-factor authentication on our root account and I'll see you in 135
that one