(title reverberates)
An IAM role is like an IAM user.
It's an AWS identity with permission policies
that determine what an identity can and cannot do
in your AWS environment.
However, instead of being uniquely associated
with one person, a role can be assumed by anyone
who needs it.
You can define the access that a role has by using a policy.
A policy is an entity that when attached to an identity
or resource, defines their permissions.
For example, we can have a policy which allows
read-only access to a service like IAM or EC2.
In this ACG Fundamental, we're gonna take a look
at how to create a role and a policy and attach
that policy to the role.
(keyboard tapping)
Alrighty, I am inside the AWS Management Console
and I'm gonna select IAM.
On the left side of the navigation pane,
I'm going to select on Roles and then Create a role.
We're gonna select another AWS account
and provide the account ID.
Next, I'm gonna hit Permissions.
(keyboard tapping)
We're gonna create a new policy during the actual
role creation process.
So let's say Create policy.
It should open a new tab and I'm gonna select
the JSON tab.
Erase what we've gotten here and then paste
in some JSON that I've copied.
Version is just a version of the policy format
that we're following. Statement is actually
what the policy is gonna be doing.
Effect is allow, so this policy will allow
these following actions.
This will allow read-only access to the IAM console.
So next.
And let's hit Review.
Let's provide a name.
ReadOnlyIAMAccess.
Read-only access to IAM console.
So we've got our name and description in here.
Let's hit Create.
Alrighty, let's head back to that original tab
where we were creating the role,
to refresh and remember, ReadOnlyIAMAccess
is the name of the policy.
ReadOnlyAccess.
Here we go, let's select it and then hit next.
We don't need any tags, so we can hit Next Review
and let's provide a name here.
ReadOnlyIAMRole.
Role for read-only access to IAM.
Fantastic.
Let's say Create role, add back in our Roles,
we can take a look at it and here we are.
Great, now our role and policy have been created,
this means any user cannot log in assume
our newly created role, and they'll have the permissions
described in the policy that we attached to that role.
In this case, read-only access to the IAM console.
Great.
(keyboard tapping)
Now, let's go ahead and delete the role.
Let's go back into Roles, we'll select that one,
hit Delete role,
hit Yes, delete.
All set, that is it for this demo.
We've accessed the AWS console, created a role
for users to assume, added permissions to that role
via a new policy, and we know how to remove the role too.
I'll make sure to link some additional resources
in the show notes so you can check
and read more about AWS roles and policies.
Alrighty, Cloud Gurus, that's it for this episode
of ACG Fundamentals.
Go on and secure your AWS environments
by creating AWS roles and policies.
Let me know how it goes in the comments.
Keep being awesome Cloud Gurus.
I'll see you in the next one.