# IAM Section

### IAM: Users & Groups

• IAM = Identity and Access Management, **Global** service&#x20;

• Root account created by default, shouldn’t be used or shared&#x20;

• Users are people within your organization, and can be grouped&#x20;

• Groups only contain users, not other groups&#x20;

• Users don’t have to belong to a group, and user can belong to multiple groups

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FHCN6R5VrxxkNEVgMJg8b%2Fimage.png?alt=media\&token=0202246c-6afa-479e-92fb-73e4959824ca)

### IAM: Permissions

• **Users or Groups** can be assigned JSON documents called policies&#x20;

• These policies define the **permissions** of the users&#x20;

• In AWS you apply **the least privilege principle:** don’t give more permissions than a user needs

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FRsoKhqgT6iKTmZoU9uoO%2Fimage.png?alt=media\&token=7c1af009-9722-443a-affe-f215d5312189)

Account Alias = bu 12 reqemli kod evezine account id evezine istifade edilir yeni sözler yazaraq id yerine istifade ede bilersen ev bundan basqa ordaki url ni kopy edende gire bilirsen user name ve parolu bilersense tebiki&#x20;

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FTcptD0bRYJRSzT9p0q1G%2Fimage.png?alt=media\&token=3ba94a1b-df83-43af-a86c-bd16a8e91914)

## IAM Policies inheritance

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2F8WfKeoseXcEi1gqNkkV3%2Fimage.png?alt=media\&token=144cc8fe-28d1-4313-9831-b85bab9dd0ae)

## IAM Policies Structure

### • Consists of •&#x20;

### Version: **policy language version, always include “2012 -1017”**&#x20;

**• Id**: an identifier for the policy (optional)&#x20;

**• Statement:** one or more individual statements (required)&#x20;

### • Statements consists of&#x20;

**• Sid**: an identifier for the statement (optional)&#x20;

**• Effect:** whether the statement allows or denies access (Allow, Deny)&#x20;

**• Principal:** account/user/role to which this policy applied to&#x20;

**• Action**: list of actions this policy allows or denies&#x20;

**• Resource**: list of resources to which the actions applied to&#x20;

**• Condition**: conditions for when this policy is in effect (optional)

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FtITyGImk3JIIxhnIIAFw%2Fimage.png?alt=media\&token=16141d25-5c87-4ea3-b777-92f17187caa3)

## IAM – Password Policy&#x20;

**• Strong passwords = higher security for your account**&#x20;

**• In AWS, you can setup a password policy:**&#x20;

• Set a minimum password length&#x20;

**• Require specific character types:**&#x20;

&#x20;       • including uppercase letters&#x20;

&#x20;       • lowercase letters&#x20;

&#x20;         • numbers

&#x20;        • non-alphanumeric characters&#x20;

• &#x20;

• **Require users to change their password after some time (password expiration)**&#x20;

• **Prevent password re-use**

## Multi Factor Authentication - MFA

• Users have access to your account and can possibly change configurations or delete resources in your AWS account&#x20;

• You want to protect your Root Accounts and IAM users&#x20;

• MFA = password you know + security device you own

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FFSab66HGuHn0smVCRMYB%2Fimage.png?alt=media\&token=9d1198a8-c9af-4678-98e0-7edcc01a4bd6)

• Main benefit of MFA: if a password is stolen or hacked, the account is not compromised

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2Fe5LZHsCTQQzWafClybVi%2Fimage.png?alt=media\&token=027ebc71-ae04-42b4-acba-7fd76e5f88f1)

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2Fzu34MQ4jnif9lcKmox9c%2Fimage.png?alt=media\&token=7692a975-39b3-4b70-a036-e4c818165fdd)

## How can users access AWS ?

**• To access AWS, you have three options:**&#x20;

&#x20;        • AWS Management Console (protected by password + MFA)&#x20;

&#x20;        • AWS Command Line Interface (CLI): protected by access keys&#x20;

&#x20;      • AWS Software Developer Kit (SDK) - for code: protected by access keys&#x20;

• Access Keys are generated through the AWS Console&#x20;

• Users manage their own access keys&#x20;

• Access Keys are secret, just like a password. Don’t share them&#x20;

**• Access Key ID** \~= username&#x20;

**• Secret Access Key** \~= password

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2F2o9RyP10b8Xj4P9MP33N%2Fimage.png?alt=media\&token=d8e94502-cdf2-425b-9d33-04e5cfd64836)

## What’s the AWS CLI?

• A tool that enables you to interact with AWS services using commands in your command-line shell&#x20;

• Direct access to the public APIs of AWS services&#x20;

• You can develop scripts to manage your resources&#x20;

• It’s open-source \*\*<https://github.com/aws/aws-cli**&#x20>;

• Alternative to using AWS Management Console

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2F80ZUf1fCYKIg2YdvhkHf%2Fimage.png?alt=media\&token=69d1d9f9-0535-469e-abba-4a4e4377c437)

## <mark style="color:blue;">What’s the AWS SDK?</mark>

• AWS Software Development Kit (AWS SDK) &#x20;

• Language-specific APIs (set of libraries)&#x20;

• Enables you to access and manage AWS services programmatically

&#x20;• Embedded within your application

&#x20;**• Supports**&#x20;

&#x20;      • SDKs (JavaScript, Python, PHP, .NET, Ruby, Java, Go, Node.js, C++)&#x20;

&#x20;       • Mobile SDKs (Android, iOS, …)&#x20;

&#x20;       • IoT Device SDKs (Embedded C, Arduino, …)&#x20;

• Example: **AWS CLI is built on AWS SDK for Python**

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FmNYVb7TBGbtmVuhgy32C%2Fimage.png?alt=media\&token=f1435a4f-125a-4769-a824-1fe3c03bbd39)

**Aws CLI install windows =instal comend line for aws in windows**

### aws CLI instal for linux

{% hint style="success" %}
`$ curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"`

`unzip awscliv2.zip`

`sudo ./aws/install`
{% endhint %}

## [`https://docs.aws.amazon.com/cloudshell/latest/userguide/faq-list.html#regions-available`](https://docs.aws.amazon.com/cloudshell/latest/userguide/faq-list.html#regions-available)

## CLI CREDENTIALS FOR AWS TO LINUX WITH ACCES KEY

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FgS3HqanWHjJ2ZECJe7ly%2Fimage.png?alt=media\&token=ad5f6019-6290-4e91-823f-16f88c17a479)

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FqvNbFcBlOG9VUr4unepF%2Fimage.png?alt=media\&token=866737c7-18fd-4875-87db-fe7297b429cb)

## AWS CloudShell&#x20;

it is a terminal like CLI but it is icloude aws console you can use it into the aws&#x20;

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FNKYMY8WmgDdxs5HB12G9%2Fimage.png?alt=media\&token=b0619e02-53fe-4f5e-87ca-b665f96d1da4)

## IAM Roles for Services

• Some AWS service will need to perform actions on your behalf&#x20;

&#x20;• To do so, we will assign permissions to AWS services with IAM Roles&#x20;

**• Common roles:**&#x20;

&#x20;     • EC2 Instance Roles&#x20;

&#x20;     • Lambda Function Roles&#x20;

&#x20;    • Roles for CloudFormation

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FbIq4ZLosUDqiORIIDAhs%2Fimage.png?alt=media\&token=dd02d75f-95ae-4625-b700-d91d63a03fb5)

## IAM Security Tools

**• IAM Credentials Report (account-level)**&#x20;

&#x20;        • a report that lists all your account's users and the status of their various credentials

&#x20;**• IAM Access Advisor (user-level)**&#x20;

&#x20;     • Access advisor shows the service permissions granted to a user and when those services     were last accessed.&#x20;

&#x20;    • You can use this information to revise your policies

## IAM Guidelines & Best Practices

• Don’t use the root account except for AWS account setup &#x20;

**• One physical user** = One AWS user

&#x20;• Assign users to groups and assign permissions to groups&#x20;

• Create a strong password policy&#x20;

• Use and enforce the use of Multi Factor Authentication (MFA)

&#x20;• Create and use Roles for giving permissions to AWS services

&#x20;• Use Access Keys for Programmatic Access (CLI / SDK)&#x20;

• Audit permissions of your account with the IAM Credentials Report

&#x20;• Never share IAM users & Access Keys

## **IAM Section – Summary**&#x20;

**• Users**: mapped to a physical user, has a password for AWS Console&#x20;

**• Groups:** contains users only&#x20;

• **Policies**: JSON document that outlines permissions for users or groups&#x20;

• **Roles**: for EC2 instances or AWS services

&#x20;• **Security**: MFA + Password Policy&#x20;

• Access Keys: access AWS using the CLI or SDK&#x20;

**• Audit:** IAM Credential Reports & IAM Access Advisor
