AWS Identity and Access Management - 2021

 

            AWS Identity and Access Management - 2021

AWS Identity and Access Management (IAM) permits you to have numerous clients in your AWS account. On the off chance that you utilized Amazon Web Services (AWS), the best way to deal with your substance on AWS is to give a username and secret key or access keys. This is a genuine security issue for the greater part of us. IAM doesn't need to share passwords and access keys. 

Continually changing the principle AWS secret word or producing another vital when a representative leaves our group is only a chaotic arrangement. AWS Identity and Access Management (IAM) was a decent beginning, permitting individual client accounts with individual keys. In any case, since we are S3/CloudFront clients, CloudFront was added to IAM to watch in the event that it happened last. The executives (IAM) support CloudFront. IAM began in 2010 and incorporates S3 support

I discovered the documentation for this help somewhat dispersed. There are a few outsider items that offer extensions for help for character and access to the executives (IAM). In any case, engineers are by and large economical, so they searched for a free answer for overseeing IAM with the Amazon S3 administration. 

This article strolls you through the most common way of setting up an order line interface with IAM backing and setting up gatherings/clients with S3 access. Before you begin designing Identity and Access Management (IAM), you need to set up your Amazon AWS S3 account. My article, Amazon Simple Storage Service (S3), will direct you bit by bit through setting up an AWS S3 account.

Here are the steps to set up and implement users in IAM. This is for Windows but can be adapted for use on Linux, UNIX, and/or Mac OSX.

1. Command-line interface (CLI) installation and configuration
2. Create a group
3. Granting Group Access to S3 Bucket and CloudFront
4. Create a user and add it to a group
5. Create login profile and create key
6. access test    
   
   
   

Command-line interface (CLI) installation and configuration

The IAM Command Line Toolkit is a Java program accessible in Amazon's AWS Developers Tools. You can utilize this apparatus to run IAM API orders from a shell utility (DOS for Windows). 

• You should be running Java 1.6 or higher. You can download the most recent adaptation from Java.com. To check the rendition introduced on your Windows framework, open an order brief and type the java - adaptation. This accepts that java.exe is in your PATH. 

• Download the IAM CLI tool stash and unfasten it someplace on your neighborhood drive. 

• There are 2 documents in the CLI toolbox root that should be refreshed. 

• AWS-credential.template: This document contains your AWS accreditations. Add AWSAccessKeyId and AWSSecretKey, save and close the record. 

• client-config.template: You should refresh this document provided that you need an intermediary server. Eliminate the # sign and update ClientProxyHost, ClientProxyPort, ClientProxyUsername and ClientProxyPassword. Save and close the document. 

• The following stage is to add climate factors. Go to Control Panel | System Properties | Advanced System Settings | climate variable. Add the accompanying factors:

• AWS_IAM_HOME: Set this variable to the directory where you unzipped the CLI toolkit. If you run Windows and unzip it from the root of drive C, the variable will be C: IAMCli-1.2.0.
• JAVA_HOME: Set this variable to the directory where Java is installed. This is the location of the java.exe file. On a typical Windows 7 Java installation, C:Program Files (x86) Java is similar to jre6.
• AWS_CREDENTIAL_FILE: Set this variable to the path and file name of the aws-credential. the template you updated above. If you run Windows and unzip it in the root of drive C, the variable will be C:IAMCli-1.2.0 aws-credential.template.
• CLIENT_CONFIG_FILE: You should add this environment variable only if you need a proxy server. If you run Windows and unzip it from the root of drive C, the variable is C: IAMCli-1.2.0 client-config.template. Don't add this variable unless you need it
• Test the installation by going to a command prompt and typing iam-userlistbypath. It should go as long as you don't get an error.

All IAM commands can be run from the command prompt. All commands start with "iam-".

Create a group

You can create up to 100 groups for each AWS account. You can set permissions in IAM at the user level, but it's best to use groups. The following is the process of creating a group in IAM.

• The group creation syntax is iam-groupcreate -g GROUPNAME -p PATH -v where -p and -v are optional. Full documentation for the command line interface is available in the AWS documentation.
• To create a group called "awesomeusers", type iam-groupcreate -g awesomeusers at the command prompt.
• You can verify that the group was created correctly by typing iam-grouplistbypath at the command prompt. Only if you created this group will you get something like "arn:aws:iam::123456789012:group/awesomeusers". where number is your AWS account number.

Granting Group Access to S3 Bucket and CloudFront

Policies control what a group can do in S3 or CloudFront. By default, groups don't have access to anything in AWS. I found the documentation for the policies to be fine, but creating a handful of policies I did by trial and error to get them to work the way I wanted them to work.

There are several options for writing a policy. One option is that you can type directly into the command prompt. It seemed easier to add the policy to a text file and then use the iam-groupuploadpolicy command to upload the text file as a parameter, since you can also create and tweak the policy. Here is the process of using a text file and uploading it to IAM.

Use something like Notepad, type the following text and save the file.

• {
• "statement":{
• "Effect": "Allow",
• "action": "s3: *",
• "will":
• "arn:aws:s3:::BUCKETNAME",
• "arn:aws:s3 :::BUCKETNAME /*"
• },
• {
• "Effect": "Allow",
• "Action": "s3:ListAllMyBuckets",
• "resource": "arn:aws:s3:::*"
• },
• {
• "Effect": "Allow",
•  
• "action": "cloudfront: *",
• "will":"*"
• }
•  
• }
• This policy has three sections. This effect is used to allow or deny some types of access. Actions are specific things a group can do. Resources are used to access individual bucket
• You can limit work individually. In this example, the groups "Action": "s3 : GetObject", "s3 : ListBucket", "s3 : GetObjectVersion" can list the contents of a bucket and download objects.
• The first section "allows" the group to perform any S3 operation on the "bucket name" bucket.
• The second section "allows" the group to list all buckets in S3. You can actually see the bucket list using something like the AWS Console.
• The third section gives the group full access to CloudFront.

IAM policies have many options. Amazon has a useful tool called the AWS Policy Generator. This tool provides a GUI where you can write policies and generate the actual code needed to implement the policies. You can also check the Access Policy Languages ​​section of the Using AWS Identity and Access Management online documentation.

Create user and add to group

• Creating a new user and adding them to a group to give them access is a two-step process. The user-generated syntax is: iam-usercreate -u USERNAME -p PATH -g GROUPS … -k -v where -p, -g, -k, and -v are optional. Full documentation for the command line interface is available in the AWS documentation.
• To create user "bob", type iam-usercreate -u bob -g awesomeusers at the command prompt.
• You can verify that the user is created correctly by typing iam-grouplistusers -g awesomeusers at the command prompt. If you only created this user, you will see output like "arn:aws:iam::123456789012:user/bob". where number is your AWS account number.

Create a logon profile and create a key

At this point we have created a user, but we need to provide the user with a way to actually add or remove objects in S3. There are two options you can use to give your users access to S3 using IAM. You can create a login profile and give the user a password. They can use their credentials to log into the Amazon AWS Console. Another option is to provide the user with an access key and a secret key. You can use this key in third-party tools like S3 Fox, CloudBerry S3 Explorer, or S3 Browser.

Create a login profile

When you create a login profile for your S3 users, you provide a username and password that you can use to log in to the Amazon AWS Console.

• The syntax for creating a login profile is iam-useraddloginprofile -u USERNAME -p PASSWORD. Full documentation for the command line interface is available in the AWS documentation.
• To create a login profile for user "bob", type iam-useraddloginprofile -u bob -p PASSWORD at the command prompt.
• You can verify that the login profile was created correctly by typing iam-usergetloginprofile -u bob at the command prompt. If you created a login profile for bob, you will get output like "A login profile exists for your user profile".

create key

Once you have created an AWS Secret Access Key and a corresponding AWS Access Key ID, you can use third-party software such as those mentioned previously. As a security measure, keep in mind that you can only obtain the key during the user profile addition process. Copy and paste the output from the command prompt and save it to a text file. You can send files to users.

• The syntax for adding a key for a user is iam-useraddkey -u USERNAME. Full documentation for the command line interface is available in the AWS documentation.
• To create a key for user "bob", type iam-useraddkey -u bob at the command prompt.
• This command will output the following keys:
• AKIACOOB5BQVEXAMPLE
• bidirectional
• The first line is the access key ID and the second line is the secret key. Third-party software requires both.

access test

Now that we have created an IAM group/user and have access to the group using the policy, we need to test access.

Console access

Users can log in to the AWS Console using their username and password. However, this is not the normal console login page used for your default AWS account. You can use a special URL that provides a login form only for Amazon AWS accounts. Here is the URL to log in to S3 for IAM users.

https://AWS-ACCOUNT-NUMBER.signin.aws.amazon.com/console/s3

AWS-ACCOUNT-NUMBER is your typical AWS account number. You can get this information by logging into the Amazon Web Service login form. Log in and click Account | account activity. Your account number is in the upper right corner. Make sure you remove the dash. The URL should look something like https://123456789012.signin.aws.amazon.com/console/s3.

Use access key

You can download and install the third-party tools already mentioned in this article. Enter your access key ID and secret key according to the third-party tool documentation.

It is strongly recommended that you create an initial user and fully test that that user can do everything you need to do in S3. Once you've identified one of your users, you can set up all of your S3 users.