Module 8 – Challenge Lab: Controlling AWS Account Access by Using IAM

Scenario

After speaking with Mateo about the café's AWS infrastructure, Sofía realized that she must address some basic security concerns about the way that the café staff has been using the AWS account.

The café is now large enough that team members who build, maintain, or access applications on AWS are specializing into roles (such as developer or database administrator). Up to now, they haven’t made an effort to clearly define what level of access each user should have based on their roles and responsibilities.

Sofía spent some time thinking about what each person should be able to do in the account, especially with AWS Cloud9, Amazon Elastic Compute Cloud (Amazon EC2) and Amazon Relational Database Service (Amazon RDS). She made some decisions and created this chart, which describes how she would like to define access rights in the AWS account:

IAM Group	IAM User	AWS service access	Reason
App Developers	Nikhil	AWS Cloud9 access to Amazon EC2 development environment. Also, read-only access to Amazon EC2.	Nikhil often works as an application developer. He should be able to access the AWS Cloud9 environment for the development environment of the café web application. However, he shouldn't have access to the production environment. He should also be able to see all Amazon EC2 resources and configuration details, but he shouldn't be able to modify them.
DB Administrators	Olivia	Full access to Amazon RDS.
Also, full access to AWS Systems Manager.	Olivia was hired as a contract database administrator to help manage the database that the café web application uses. She should thus have full Amazon RDS access rights. She will also need access to AWS Systems Manager, where the database connection information is stored. However, beyond access to these two services, Sofía can't think of any reason why Olivia would need more access to AWS resources.

Notice that instead of assigning permissions directly to users, Sofía decided to define IAM groups. Next, she will attach the IAM policies that grant access to those groups. Then, she plans to assign the users to the appropriate groups. If the café hires more developers or database administrators, she can add them as new users to the groups. The new users will inherit the correct permissions for their role in developing and maintaining the AWS account infrastructure. This approach will scale as the café expands.

Now that Sofía knows what access rights she wants to assign to which users, she's ready to get started!

Lab overview and objectives

In this lab, you will use AWS Identity and Access Management (IAM) to define different access rights for different users. You will test access and adjust access. You will also observe how the access rights that you grant affect what actions the IAM users can perform on AWS account resources.

After completing this lab, you should be able to:

Create IAM users and IAM groups, and associate IAM policies with IAM groups
Indicate how limited access rights affect what resources IAM users can access and what actions they can take
Use AWS managed IAM policies to modify user access rights and observe the results
Use the IAM Policy Simulator to observe the scope of the access that is granted by different policies
Access the IAM Access Advisor to observe what access rights different users are taking advantage of
Create custom IAM policies by using the visual editor

When you start the lab, the following resources are already created for you in the AWS account:

Untitled