Objectives
- Create a user account
- Create a role
- Assign permissions to a role
Lab Details
- Create 3 IAM users:
user-1,user-2,user-3. - Create 3 IAM groups:
S3-ADMIN,S3-SUPPORT,EC2-SUPPORT. - Attach the following policies to the groups created in the previous step:
- S3-ADMIN — AmazonS3FullAccess
- S3-SUPPORT — AmazonS3ReadOnlyAccess
- EC2-SUPPORT — AmazonEC2ReadOnlyAccess
- Assign the following user/group memberships:
- user-1 should belong to the S3-ADMIN group
- user-2 should belong to the S3-SUPPORT group
- user-3 should belong to the EC2-SUPPORT group
Take a screenshot of the groups showing the users belonging to each group.
- Sign in and verify the accounts have the correct permissions. Note: use a private window or user credentials will get cached in the browser.
- Use the account “user-1” to create a new S3 bucket. Upload a
.txtfile into the bucket.Take a screenshot showing the new bucket containing the .txt file.
- Use the account “user-2” to try to create another new S3 bucket. Because this user is part of the S3-SUPPORT group, they can list buckets and view contents but cannot create a new bucket.
Take a screenshot of the error message.
- Use the account “user-3” to try to create a new EC2 instance. Make sure you use a free-tier eligible EC2 instance in case something is set up incorrectly. If your users/groups are configured properly, you should not be able to create a new EC2 instance.
Take a screenshot of the error message.
- Use the account “user-1” to create a new S3 bucket. Upload a
What did I learn?
- Creating IAM users
- Creating IAM groups
- Attaching policies and permissions to IAM groups
- Assigning user permissions by adding them to IAM groups