# Configuring AWS Identity and Access Management (IAM) **IAM** AWS IAM is a service that allows you to control who can access your AWS resources and what actions they can perform. It helps manage users, groups, and permissions, ensuring that only authorized individuals and services have access to your resources. **Components of IAM :** 1. **Users:** IAM users are entities with long-term credentials (username and password or access keys) used to interact with AWS. Each user has specific permissions assigned to them. 2. **Groups:** IAM groups are collections of users. They simplify access management by allowing you to set permissions for multiple users simultaneously. 3. **Roles:** IAM roles are similar to users, but they are meant for entities that don't represent individuals (e.g., applications, services). Roles have temporary credentials and are used to delegate access across AWS accounts or services securely. 4. **Policies:** IAM policies are JSON documents that define permissions. They specify what actions are allowed or denied on which AWS resources. Policies can be attached to users, groups, or roles to control access effectively. > In this article i will explain three scenario's > > * Scenario 1 - User to Service > > * Scenario 2 - Service to Service > > * Scenario 3 - User - Service to Service > **Sign in to the AWS Management Console:** * Go to the AWS Management Console at [https://aws.amazon.com/console/](https://aws.amazon.com/console/). ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722165609717/3b834385-cd49-47e1-9829-da4277ec1386.png align="center") **Navigate to IAM:** * In the AWS Management Console, find and select "IAM" under "Security, Identity & Compliance." ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722165697230/3082f893-268a-40af-b7b2-0f823c633b97.png align="center") ### Scenario 1 : **User to Service :** Create IAM users and grant specific permissions (eg, AmazonEC2FullAccess) **Group Creation :** **Create a New Group:** * Click on "User groups" in the left-side & Click on the "Create group" button to start creating a new IAM group ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722166522772/6dcf8f5d-3043-49ba-a721-e2f49a431c8f.png align="center") **Set Group Details:** * Enter a name for the group. Choose a descriptive name that reflects the purpose or role of the group (e.g., ec2Admin, s3admin). ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722166730296/f424ca4a-09a8-446f-ab32-6e04fa2cdc9a.png align="center") **Attach Policies :** **Attach policies directly**: Choose one or more policies to attach to the group. These policies define the permissions that the members of the group will inherit. **Create group :** * Click "Create user group" to finalize and create the IAM group. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722167006234/57d89e24-ba82-42be-9d67-d85bd31398d2.png align="center") Now, Successfully group created. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722167182771/2546d127-749b-43b1-b329-17e4bddcd9dc.png align="center") **User Creation :** Adding a new IAM Users to the IAM Group: * Click on "Users" & Click on the "Create user" ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722165823817/1299a403-9077-46eb-a37c-45c76369da28.png align="center") * Enter the username for the new IAM user. This is the name the user will use to sign in to AWS services. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722168348784/ffcc38a0-cd09-4cc9-bf52-23bf896b7cd7.png align="center") Select Auto generated password or Custom password, Click next ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722168430147/5b86b579-a6e1-4a09-9995-5b9c3e59ec26.png align="center") **Set Permissions:** * **Add user to group(s)**: Assign the user to IAM groups. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722168692148/14756463-8730-49bd-9f3a-3cf6397e50da.png align="center") Click on "Create user" ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722168795908/9a019f82-8ae3-4353-8a75-3fae2d6656e3.png align="center") Now we can see console password & .csv file Download .csv file & Open it ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722168913326/a7a493af-f8e1-47ad-8c62-b08c867d0833.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722169380666/ebcf3f8f-afb8-41f8-ab92-851a5b43b81d.png align="center") Now successfully added users to the IAM Group ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722169646078/d04af746-15bb-457f-8ae9-d4d739b521a6.png align="center") Use this console sign-in URL, Enter IAM User name and Password ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722169921701/f4e75293-5113-416d-9988-8cc42e4d9a4f.png align="center") Dinesh user need to change password ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722169998887/d98a9794-c9ba-47b7-b5de-8b464aa364e2.png align="center") Now, Dinesh user can access EC2 service only. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722170356450/65346aa9-5447-4272-869c-dd309d5206c0.png align="center") Now, Dinesh user need to view S3 bucket list only, that user don't have permission to view bucket list ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722320979428/1bae67fe-3265-4b0c-8f15-a419696513b6.png align="center") In this time, Need to add policy for S3 bucket list view to Dinesh user. Note : AWS has lot of default policies, If you want, you can use default policy ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722326551981/84ff111e-c34a-41d5-bd90-2067a8ed6fc5.png align="center") Now, need to access to S3 bucket list view only, So need to create new policy ( Customization) **Policy creation:** In the left-side menu, click on "Policies". Click on the "Create policy" ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722326944854/f3179842-6f54-4880-a3b5-d02f18bcf08e.png align="center") Click (Choose a service) ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722339427133/115ef0b3-180a-484b-ab00-96fd593f6822.png align="center") Select service "S3" ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722339508794/f03483bf-0861-47f2-82f1-255cf61073d8.png align="center") Click Access level " ListAllMyBuckets " & Select Read permission ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722340560418/572f03fe-ab00-4ceb-8b64-547d07b8db91.png align="center") Enter Policy name "S3viewBucket" ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722340660649/840fb161-8e89-4467-855d-2945b5b4e92e.png align="center") Click " Create Policy " ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722340722085/3a886d8a-83cb-437d-af22-3b9a7d197be0.png align="center") Now, Successfully "S3viewBucket" Policy created ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722340784275/7ab25243-1ade-4143-8a49-dae665ffebdc.png align="center") Need to assign this policy to Dinesh User. Go to Users, Select "dinesh" user ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722341176283/0189b623-8923-47f1-bb48-67c6dd68c552.png align="center") Click add Permissions ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722341300652/cb8c810b-ecb1-4111-a840-03fa27ea5986.png align="center") Click "Attach policy directly, then search "S3viewBuket" and Select Then, Click Next ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722341434313/64a35b4e-92b4-4700-a1a0-c352f20116f8.png align="center") Click Add Permissions ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722341579123/bc54329c-7927-4733-93cb-46554fa94cd5.png align="center") Now, Successfully policy added ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722341663920/b82f383e-0af7-4212-a21b-5314ed461948.png align="center") Now, Dinesh User can access S3 Bucket List Login AWS consloe through IAM user ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722342380058/56959209-e0d9-49fc-b3a0-ba89033cee05.png align="center") Now, Dinesh user can access Bucket List ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722342502821/bcea3e4c-b03e-432e-8494-05e86b77c81f.png align="center") ### Scenario 2 : Service to Service AWS services need to interact with each other to perform tasks, such as an EC2 instance needing to access an S3 bucket or any other services. **Role Creation :** Click on "Roles" in the left-side & Click Create role ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722343590209/425afdf5-3ddf-4988-b8af-cfc9ace12c44.png align="center") Choose the service that will use this role "EC2". For example, if you're creating a role for an EC2 instance to access S3 bucket list view, select "EC2". ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722343921080/2142001d-ff1d-4c8c-9545-22aafd20e0c3.png align="center") Add permission for S3viewBucket & Click Next ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722344156108/6aef18fb-7556-4617-8e43-a72228d0dd9d.png align="center") Enter Role name ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722344335531/5bb82de6-070d-4387-b4ef-c96e3156bff9.png align="center") Click Create role ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722344418490/53ce57b8-7b87-4364-bbf8-9ca3476444fc.png align="center") Now, "EC2-S3" Role successfully created ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722344546212/5c16399b-c625-4420-b8c5-e8cc82191f2d.png align="center") Now, I will create two EC2 instances. One is with the IAM role. Another one is without the IAM role. Because I will show you. How work IAM roles. 1st instance : EC2 with IAM role ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722345862204/627c8f5d-ee9e-4ffb-a146-3292d4e8b7e8.png align="center") 2nd Instance : EC2 Without IAM role ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722346004110/3733cd63-561f-413c-ab15-d4a368e83ac1.png align="center") Now, I have successfully launched two EC2 instances ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722346140767/041c51a3-3542-4fbd-9f81-b5b64102eef2.png align="center") Now, I open the IAM role instance through Putty. ```plaintext aws s3 ls ``` Now, We can see bucket list "dinesh-credentials" (Role attached instance) ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722346764375/b87afe0b-50bf-43c6-88a3-c5985c7f60b6.png align="center") Now, I open the instance (without the IAM role) through Putty. ```plaintext aws s3 ls ``` ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722347556596/3a466044-d886-4b02-aa4e-9c7bf7069bfc.png align="center") *Unable to locate credentials, In this time need to use scenarios three.* ### **Scenario 3** : **User - Service to Service** Dinesh users already have permission for the S3 bucket list view option, so we need to configure Dinesh user credentials in this instance. After that, we can see the S3 bucket list. Need to enter "AWS configure" command in terminal ```plaintext aws configure ``` After that, it will ask for : AWS Access ID AWS Secret Access Key Default region name Default output format Need to enter all details, ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722348423562/655f9b66-afb7-4bd9-925a-aedc846bab83.png align="center") Now, we can see the S3 bucket list. ```plaintext aws s3 ls ``` ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722348448348/6da1bbb8-4a92-4be2-ae5b-039fd2fb71c5.png align="center") Conclusion : AWS IAM is essential for securing your AWS resources by controlling who can access them and how they can interact. Following IAM best practices strengthens security and ensures compliance with industry standards. Embracing IAM is crucial for establishing a robust and dependable cloud infrastructure.