In this hands-on lab scenario, you are a security engineer working for a new startup that’s launching an online bookstore for rare and antique books. The founder, Kia, needs your help setting up her database administrators with the proper access permissions for the startup’s AWS account. In order to provide access and ensure the proper security measures are in place, you will use AWS Identity & Access Management (IAM) and attach the necessary AWS-managed policy that allows full access to Amazon Relational Database Service (RDS).
Learning Objectives
Successfully complete this lab by achieving the following learning objectives:
- Review Existing Policy Permissions for DBAGroup as an Administrator
- Log in to the AWS Management console using
cloud_user
credentials. - Navigate to IAM.
- In IAM Resources, click Groups.
- Select DBAGroup.
- From the menu, click Permissions and review the
StudentRDSPolicy
inline policy. - Click Show Policy to review the permissions provided.
- Sign out by clicking your account name on the top navigation bar and clicking Sign Out.
- Log in to the AWS Management console using
- Access a Relational Database Instance as a DBA
- Log in to the AWS Management console as
dba-1
with123456
as the password. - Navigate to Amazon Relational Database Service (RDS).
- From the dashboard, click Create database.
- Note the error 403 access denied message. We need to modify
DBAGroup
permissions as an administrator to grant DBA access. - Sign out by clicking your account name on the top navigation bar and clicking Sign Out.
- Log in to the AWS Management console as
- Modify Permissions on the DBAGroup as an Administrator
- Log in to the AWS Management console using
cloud_user
credentials. - Navigate to IAM.
- In IAM Resources, click Groups.
- Select DBAGroup.
- In Permissions, click Attach Policy.
- Select the
AmazonRDSFullAccess
checkbox and click Attach Policy. - Sign out by clicking your account name on the top navigation bar and clicking Sign Out.
- Log in to the AWS Management console using
- Verify Relational Database Access as a DBA
- Log in to the AWS Management console as
dba-1
with123456
as the password. - Navigate to Amazon Relational Database Service (RDS).
- From the dashboard, click Create database.
The error message is now gone and the DBA now has the needed permissions to create a database.
- Log in to the AWS Management console as