Sometimes you need to temporarily delegate access to AWS services
such as Amazon EC2
that normally don't have access to resources in your account.
Luckily for these scenarios,
you can delegate access using IAM roles.
This video walks you through the steps of creating an IAM role.
that will be used to delegate the Amazon EC2 service access
to an Amazon S3 bucket in your account.
This will enable an application running in EC2
to be able to read and write objects to that bucket.
This video will create an IAM role,
launch an EC2 instance with that role
and then access an S3 bucket
from the EC2 instance that we have launched.
We will first sign in as an IAM user.
This IAM user is an administrator
who has permissions to create IAM roles.
We first enter the EC2 console
to create an IAM role we need to be in the IAM console.
Click on Roles in the left-hand navigation
and then Create New Role button at the top.
Enter a name such as MyApps_role
that makes sense to you.
For this role we'll choose to use a service role type
and then select Amazon EC2.
Selecting the Amazon EC2 service role
establishes a trust relationship with the selected service.
In this case EC2.
We selected EC2 because the application is running on EC2 instances.
If we were to choose a different service role type,
this would established a trust with another AWS service.
Now we need to set permissions for the role.
This step determines what resources can be accessed
using your IAM role.
To simplify this step IAM includes a set of policy templates
that describe these permissions.
Scroll through the policy templates
and find one that best fits your needs.
In this case the application requires the ability to read and write
S3 objects from your S3 buckets
so we will choose the S3 full access template.
In this case we are able to use the existing template.
Let's imagine your use case required a custom policy.
In that case you could use the policy generator
or the custom policy option to create your own unique policy.
The resulting policy document shows that the role
can call the Get Enlist Actions from your S3 bucket
within your account.
Now that we've created a role,
let's watch an EC2 instance that uses the role.
Remember by doing so this EC2 instance
will have temporary security credentials
that can be you used to access your S3 bucket.
AWS automatically and securely delivers these credentials to the instance
and rotates them multiple times a day,
so you don't have to do that heavy lifting.
Choose an AMI that best works for your application.
In this case we'll choose a Windows AMI.
Under the IAM role you'll see MyApps role.
This instance now has the ability to access
S3 objects within your account.
Select a key pair that works best for you.
In this case we will choose the WindowsTest key pair
and then select Acknowledge.
Now that we've launched the EC2 instance
let's verify that it truly has access to your S3 buckets.
Behind the scenes the EC2 service has assumed your role
and a set of temporary security credentials
are made available to the instance.
If you are using the AWS CLI, PowerShell or one of the other SDKs,
this credentials will be picked up automatically.
To demonstrate this, I've gone ahead
and connected to an EC2 instance that has the MyApps role.
We'll use PowerShell to list the objects in a bucket
called any company 101.
The command is get-s3object anycompany101.
Now you can see that we have access that objects within this bucket
and without having to specify any access keys
as the role transparently provided them to PowerShell.
In this demonstration we looked at how IAM roles
can be used with EC2.
IAM roles can also be used for other delegation scenarios.
To learn more about IAM roles and other use cases for IAM roles
go to the IAM documentation and look for roles,
delegation and federation in the right hand navigation
or see some of the other videos on the IAM site.
For more information about specific EC2 use cases for IAM roles
go to the EC2 documentation.