Amazon Free AWS training in Stratford

'Bold text'EDX Course
Week 2 - Exercise 4

Create an AWS IAM policy
In the AWS Management Console, click Services, then click IAM to open the IAM dashboard.
In the left navigation menu, click Policies.
Click Create policy.
Click the JSON tab.
In the editor textbox, completely replace the sample policy with the following.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Sid1",
            "Effect": "Allow",
            "Action": [
                "iam:*",
                "rds:*",
                "sns:*",
                "cloudformation:*",
                "rekognition:*",
                "ec2:*",
                "cognito-idp:*",
                "sqs:*",
                "xray:*",
                "s3:*",
                "elasticloadbalancing:*",
                "cloud9:*",
                "lambda:*",
                "tag:GetResources",
                "logs:*",
                "kms:ListKeyPolicies",
                "kms:GenerateRandom",
                "kms:ListRetirableGrants",
                "kms:GetKeyPolicy",
                "kms:ListResourceTags",
                "kms:ReEncryptFrom",
                "kms:ListGrants",
                "kms:GetParametersForImport",
                "kms:ListKeys",
                "kms:GetKeyRotationStatus",
                "kms:ListAliases",
                "kms:ReEncryptTo",
                "kms:DescribeKey"
            ],
            "Resource": "*"
        }
    ]
}

Click Review Policy.
For Name, type edXProjectPolicy
Click Create policy.
 
You have successfully created an AWS IAM policy with full access to AWS IAM, Amazon EC2, Amazon S3,
 Amazon RDS, Amazon SNS, Amazon SQS, Amazon Rekognition, AWS Lambda, Amazon Cognito, AWS Cloud9,
 AWS X-Ray, and AWS CloudFormation. When you create IAM policies, follow the standard security
 advice of granting least privilege - that is, granting only the permissions required to perform a task.
 Determine what users need to do and then craft policies for them that let the users perform only those tasks.

Create IAMS User

Create an AWS IAM user, attach a policy to the user, and generate access keys.
 
In this section, you will create an AWS IAM user and attach the policy you just created to the user. 
You will then generate the access keys for the user. Those access keys will be used to make
 programmatic calls to AWS services via AWS CLI or APIs. If you are familiar with AWS IAM users,
 you may want to attempt to complete this section before reading the step-by-step instructions.
 
AWS IAM user name: edXProjectUser
Access type: Programmatic access and AWS Management Console access
Policy: edXProjectPolicy
Important: Download the .csv file with the access keys after creating the user. Also, make sure to click 
the Send email link to get the email instructions for signing in to the AWS Management Console as edXProjectUser.
 
Reminder! Be sure to protect your AWS account access keys like you would your credit card numbers 
or any other sensitive secret.
 
At the end of this exercise, you will not be using the access keys again. It is a security best practice
to remove IAM user credentials that are not needed. After this exercise, make sure to remove the access 
keys only (not the AWS Console password) for the IAM user - edXProjectUser. See more IAM Best Practices.

Create an IAMS user in detail

    In the AWS Console, click Services, then click IAM to go to the IAM dashboard.
    In the left navigation menu, click Users.
    Click Add user.
    In the User name text box, type edXProjectUser
    For Access type, select Programmatic access and AWS Management Console access.
    For Console password, you may choose either Autogenerated password or Custom password. If you choose Autogenerated, you will be prompted to change your console password when you log in to the AWS Console as the edXProjectUser user. Make sure you take a note of the password created.
    Click Next: Permissions.
    Under Set permissions for edXProjectUser section, click Attach existing policies directly.
    In the search text box for Filter, type edXProjectPolicy. Select edXProjectPolicy from the filtered list.
    Click Next: Review.
    Review the information and click Create user. You should see a success message.
    Click Download .csv to download the access key ID and secret access key.
    Note: This is your only chance to download these credentials.
    In the Email login instructions column, click Send email. You can send an email to an email address of your choice. This email contains the instructions to sign in to your AWS account with the edXProjectUser AWS IAM user credentials.
    Click Close to return to the console.
    In the left navigation menu, click Dashboard.
    Note the IAM users sign-in link. This is a special URL for IAM users, which includes your account ID. You will see the same URL in the email you just created.
    Sign out of the console, and follow the instructions provided in the email you just received to sign in to the AWS Console as the edXProjectUser AWS IAM user.