AWS Identity and Access Management (IAM) roles for Amazon Elastic Compute Cloud (EC2) provide the ability to grant instances temporary credentials. These temporary credentials can then be used by hosted applications to access permissions configured within the role. IAM roles eliminate the need for managing credentials, help mitigate long-term security risks, and simplify permissions management. Prerequisites for this lab include understanding how to log in to and use the AWS Management Console, EC2 basics (including how to launch an instance), IAM basics (including users, policies, and roles), and how to use the AWS CLI.
Learning Objectives
Successfully complete this lab by achieving the following learning objectives:
- Create a Trust Policy and Role Using the AWS CLI
- Obtain the
labreferences.txtfile from an S3 bucket provisioned with the lab. - Log in to the bastion host and set the AWS CLI region and output type.
- Create an IAM trust policy for an EC2 role.
- Create the
DEVIAM role. - Create an IAM policy defining read-only access permissions to an S3 bucket.
- Obtain the
- Create Instance Profile and Attach Role to an EC2 Instance
- Attach a managed policy to the
DEVrole. - Create the instance profile and add the
DEV_ROLEvia the AWS CLI. - Attach the
DEV_PROFILErole to an instance.
- Attach a managed policy to the
- Test S3 Permissions via the AWS CLI
- Verify the instance is assuming the
DEV_ROLErole. - List the buckets in the account.
- Attempt to view the files in the
s3bucketdevbucket.
- Verify the instance is assuming the
- Create an IAM Policy and Role Using the AWS Management Console
- Navigate to IAM > Policies.
- Create an IAM policy.
- Create a
PROD_ROLErole.
- Attach IAM Role to an EC2 Instance Using the AWS Management Console
- Navigate to EC2 > Instances.
- Attach the role to the Web Server instance.
- In the terminal, as
PROD_ROLE, list the buckets. - Attempt to view the files in the
s3bucketprodbucket. - Attempt to view the files in the
s3bucketsecretbucket.
