Amazon AWS IAM Roles and Policies

When You want to Provide access to Amazon Web Services Console or if you're planning to provide REST API Keys to your Developers of a Third Party Person, Using Providing access to Root Account Console or API Keys is not advisable since they basically will have full level access. Instead, we can rely on IAM(Identity and Access Management).

Creating an IAM User:

  1. Login to your root account and then Click on your Username on the Top Right Corner. Select Security Credentials.
  2. Click on Users Option on Left Hand Menu of the Dash Board Page. see here to see the Dashboard
  3. Click on Create User button
  4. Enter the Usernames of accounts to generate and click on Create.
  5.  you will be offered to Download the REST API keys.
  6. Download it or save them, Note that REST API Keys are only generated only once. If Lost you may have to reset API Keys again.

Generating Password For the User:

  1. Select The user in Users Page and click on User Actions and select Manage Password.
  2. You will be offered Two options
    • Automatic Password with Change on Login checkbox.
    • Custom Password.
  3. After Setting Password, Click on Apply.

Policies:

Policies play a VITAL Role. It is Authorization Part of IAM User. AWS Provides a set of its own policies which restricts or provide access to the User. Most of those Policies are either full Access on Service or Read only Permissions on  Service. None of those restrict a User to have access only to specific sections of the service.(Like only specific Buckets in S3 or few Instances in EC2). Here we can Use Custom Policies. Now we are going to see an example on restricting a user to only a specific Bucket in S3.

Steps to Create a Custom Policy:

  1. Select policies in DashBoard Menu
  2. Click on Create Policy
  3. select type of Policy. here you can select either copy from amazon policies and customize them(Copy an AWS Managed Policy) or create your policy from Amazon options(using Policy Generator) or create a fully custom Policy(Create Your Own Policy).
  4. Select Create Your Own Policy and copy paste this JSON.
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::dinesh_my_bucket",
                "arn:aws:s3:::dinesh_my_bucket/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": "s3:ListAllMyBuckets",
            "Resource": "arn:aws:s3:::*"
        }
    ]
}

Now Validate and click on save.

Here First Part of JSON gives full access permissions on bucket "micropyramid" to users under the policy, Second Part where it says List all Buckets gives access over Console view of S3 to the user.

Now you can assign users this policy, or  generate a Role with Custom Permissions and assign that role to the User

For more on S3 Policies click here

Posted On 04 December 2012 By MicroPyramid


Need any Help in your Project?Let's Talk

Latest Comments
Related Articles
Paginating S3 objects using boto3

When using Boto you can only List 1000 objects per request. So to obtain all the objects in the bucket. You can use s3's paginator.

Continue Reading...
How to process message queuing system by amazon SQS

Amazon Simple Queue Service (Amazon SQS) is a distributed messaging queue oriented service.
Queued items in SQS are called messages which are variable in size ...

Continue Reading...
how to setup custom domain for amazon cloudfront

We all want our own domain name to be setup for cloud front instead of amazon default cloud front domain name. We need two things ...

Continue Reading...
open source packages

Subscribe To our news letter

Subscribe and Stay Updated about our Webinars, news and articles on Django, Python, Machine Learning, Amazon Web Services, DevOps, Salesforce, ReactJS, AngularJS, React Native.
* We don't provide your email contact details to any third parties