hello everyone in this video we will take a look at creating a user policy and a user role
to assign to that policy and traditionally you'll want to do this when you want to limit
the permissions that a particular service or individual user has to operate across your
environment in this case we will be creating a policy that has full permissions on s3
as well as dms which is the data migration services
and this is a prerequisite to the next video if you're following along alright so let's
get started first thing you'll want to do is go up to the services tab and select iam
which stands for identity and access management select policies and let's create a policy
as we mentioned before the first one we'll focus on is s3 so you can type it in and select it
here you can limit specific access level maybe you just want read or write or whatever in this
case we're going to give it full permissions and also we're going to allow it to do this to
all resources in a production environment you could actually limit this if you really wanted
to you know to specific individual buckets or you know you can get really specific with this
so let's add another one in this case dms
we'll do the same thing here and just give it full permissions
and here we can see that both resources are added to this policy any role that gets assigned to this
policy will have these permissions now let's give it a name we'll just call it demo dms s3 policy
and create
now if we search for it there it is we can see everything that we just created now next
let's create a role and a role is something that usually gets assigned to an individual resource
so in this example let's say we're creating our data migration service and we want it
to be able to take all of our changes that we make in mysql and migrate it to an s3 bucket
if we want to automate that when we create that it's going to be assigned a role and that
role needs these permissions so that's why we're creating it here that's one example and it'll make
more sense if you keep following along but there's a lot of applications for this in this case we're
going to assign it to a specific service and for us it's going to be dms as mentioned in the just
a moment ago now what permissions do we want to give this role and by permissions we mean
policies we'll use the one we just created not going to add any tags and we'll give it a name
create and create role all right it's been created i actually realized i named this
role dms policy so i apologize that's actually confusing it should be
i mean really would be named demo dms role but just bear with me here but here we can see it
is created it has a specific id a role arn at the top and that is actually what we will use
to reference in the future when we want to assign this role to this service in our case dms so
that's it for this video creating these roles and policies are actually really easy we can
get really into the specific permission settings but for the sake of this example i just wanted
to show you how to create one from scratch very simple and i think it'll make a lot more sense
once we get into the next video which will be using this on our dms migration so thanks for
watching if you enjoyed this and found this useful please feel free to subscribe if you
have any questions please leave a comment happy to answer them and i will see you at the next video