IAM: Users and Groups

 IAM

• IAM - Identity and Access Management, Global Service
• Root account created by default, shouldn't be used or shared
• Users are people within your organization, and can be grouped
• Groups only contain users, not other groups
• Users don't have to belong to a group, and user can belong to multiple groups

IAM: Permissions

• Users or Groups can be assigned JSON documents called policies for accessing AWS
• These policies define the permissions of the users
• In AWS you apply the least privilege principle: don't give more permissions than a user needs

So we can create the user in IAM and can assign the policy to it while creating the group for it and providing desired policy to the group as it will help to take of users at a time.

We can even provide alias name to account and even use tags for groups.

AWS even provide multiple session in an account to access side by side. Account will make difference to resource usage one account resources can't be used by other until shared.

IAM Policies inheritance

IAM Policies Structure

• Consists of:
• Version: policy language version, always include "2012-10-17"
• id: an identifier for the policy (optional)
• Statement: one or more individual statements (required)
• Statements consists of
• Sid: an identifier for the statement (optional)
• Effect: whether the statement allows or denies access (Allow, Deny)
• Principal: account/user/role to which this policy applied to
• Action: list of actions this policy allows or denies
• Resource: list of resources to which the actions applied to
• Condition: conditions for when this policy is in effect (optional)

IAM - Password Policy

• Strong passwords - higher security for your account
• In AWS, we can setup a password policy:
• Set a minimum password length
• Require specific character types:
• including uppercase letters
• lowercase letters
• numbers
• non-alphanumeric characters
• Allow all IAM users to change their own passwords
• Require users to change their password after some time (password expiration)
• Prevent password re-use

Multi Factor Authentication - MFA

• Users have access to your account and can possibly change configurations or delete resources in your AWS account
• You want to protect your Root Accounts and IAM users
• MFA = password you know + security device you own
• Benefit:
• if a password is stolen or hacked, the account is not compromised

MFA devices options in AWS

• Virtual MFA device - will support multiple account and users to login from one device with multiple tokens. Each account and user has it's own token.
• Google Authenticator (phone only) - working on one phone at a time.
• Authy (phone only) - Support multiple tokens on a single device.
• Universal 2nd Factor (U2F) Security Key
• Yubikey by Yubico (3rd party) - it is a physical device like pendrive.
• Support for multiple root and IAM users using a single security key.
• Hardware key Fob MFA Device
• Provided by Gemalto (3rd party)
• Hardware Key Fob MFA Device for AWS GovCloud (US)
• Provided by SurePassID (3rd party)

Ways to access AWS:

• To access AWS, you have three options:
• AWS Management Console (protected by password + MFA)
• AWS Command Line Interface (CLI): protected by access keys
• AWS Software Developer Kit (SDK) - for code: protected by access keys
• Access Keys are generated through the AWS Console
• Users manage their own access keys
• Access Keys are secret, just like a password. Don't share them
• Access Key ID ~= username
• Secret Access Key ~= password

What's the AWS CLI?

• A tool that enables you to interact with AWS services using commands in your command-line shell
• Direct access to the public APIs of AWS services
• You can develop scripts to manage your resources
• It's open-source https://github.com/aws/aws-cli
• Alternative to using AWS Management Console

What's the AWS SDK?

• AWS Software Development Kit (AWS SDK)
• Language-specific APIs (set of libraries)
• Enables you to access and manage AWS Services programmatically
• Embedded within your application
• Supports
• SDKs (JavaScript, Python, PHP, .NET, Ruby, Java, Go, Node.js, C++)
• Mobile SDKs (Android, iOS,...)
• IoT Device SDKs (Embedded C, Arduino, ....)
• Example: AWS CLI is built on AWS SDK for Python

Directly download the AWS CLI from google install it.

Assigning AWS access key to AWS CLI:

aws configure

It will ask for :

AWS Access Key ID [None] :

AWS Secret Access Key [None] :

Default region name [None] : eu-east-1 (you can provide any listed in AWS console for login)

Default output format [None] :

Command to check all users:

aws iam list-users

AWS CloudShell:

It is a CLI available in browser what ever you will create files in it will stay there forever until you delete it.

You can download and upload files as well in this browser CLI.

It is a Unix Terminal on browser for using AWS with pre-installed software and package for usage.