With the basics out of the way, let's get to the main part of this chapter, that is, creating and working with users and groups.

Users, as the name suggests, are your everyday typical end users who will be interacting with the AWS products and services. Each user is provided with a unique password and a username so they can log in to the AWS Management Console. Along with the basic set of credentials, the users can also enhance their security by leveraging MFA. As discussed earlier, MFA provides a uniquely generated pin or code that is generated on a special hardware device called as a hard token. You can use this MFA pin or code along with your secure credentials to log in to the AWS Management Console.

Users are also provided with a set of access keys. These keys consist of an access key ID and a secret key, both of which can be used to log in to AWS programmatically. When the users are first created in IAM, they do not have a password or any access keys generated for them. This is your task as an AWS administrator, and you must make sure that each user has their own set of keys and passwords generated.

There are a lot of ways that you can start creating users. From the IAM dashboard, select the Manage Users option listed under the Create individual IAM users dialog box, as shown:

This will bring up the users console, using which we will create our very first IAM users. Select the Create New Users option to get started:

In the next page, type in the IAM usernames as required. You can enter up to five names at a time. You can optionally choose to create and generate access keys for each of the users that you create. Select the Generate an access key for each user option as shown and click on Create to proceed:

Select the Download Credentials option to save the user's access IDs and secret keys. This will download a CSV file on to your desktop, which has to be saved in a very secure location. It is very important that you save the keys, as this is the last time you will have access to it. Select Close after you have downloaded your credential keys successfully:

But wait! You are not done yet! You still need to assign your users their passwords. To do this, from the users console page, select the individual user's checkbox, click on the User Actions drop-down menu and select the Manage Password option as shown. You can use this drop-down menu to manage the user's access keys, signing certificates, MFA devices, and so on:

In the Manage Password page, you can either choose to Assign an auto-generated password for your users or provide a custom, temporary password, which the user can change at the first sign in attempt. In our case, we provided our user with a strong password that does not need to be changed at the first login attempt. Once the password is entered, click on Apply to save the changes:

Follow the same process for the rest of your users as well. Make sure you provide them with strong passwords that contain at least one upper case letter, one special character, and some numerical values as well. You can additionally set password policies on your entire account by selecting the Account Settings option from the IAM console's navigation pane. Using the Password Policy page, select the security options that you wish to enable for your account's IAM user passwords. Remember to select Apply password policy to save and enforce the new password policy settings:

With your users created, the next logical entity to create is the group. A group is a collection of IAM users that has a particular set of permissions assigned to it. For example, a set of users who perform administrative tasks can be clubbed under a common group called as administrators, and so on and so forth. In this section, we will create an administrative group for our use case and later assign a user to it. So, let's get started!

First up, from the IAM console, select the Groups option from the navigation pane. This will bring up the groups console using which you can create and administer groups for your AWS account.

Select the Create New Group option to get started. Provide a suitable name for your administrative group; in this case, we provided the name Admin-All-About-Dogs. The Group Name can be anything, but it's advised to keep it meaningful. Click on Next Step to continue:

Next up, we assign permissions to the group using one or two policies. A policy is a document that lists one or more permissions. You can attach policies to virtually anything in AWS, from users and groups to individual AWS resources as well.

To attach a policy to a group, from the Attach Policy page, use the Filter menu and the search box to find suitable policies. In this case, we want this group to have full administrative privileges, and hence we are searching for an Administrator Access policy. In the list of policies, select the appropriate policy and click on Next Step to continue:

In the Review page, review Group Name and the policies that are attached to the group. You can optionally choose to Edit Group Name or Edit Polices as per your requirements here. Once done, click on Create Group to proceed with the group's creation. Similarly, you can create groups for various other departments within your own organization, such as Developers group, Testers group, and so on:

To add users to any particular group, simply select the group's checkbox and from the Group Actions drop-down menu select the Add Users to Group option. This will open up a separate page where you can select your previously created users. You can add one or more users to a group as you see fit. A particular user can also be a part of two or more groups at the same time; however, this is not a recommended practice and should be avoided unless absolutely required. Once the users are selected, click on the Add Users option to complete the process. With this stage completed, you have now successfully created and set up users and groups within your own organization. Now, wasn't that easy! Just remember to use the IAM users sign in link to sign in to the AWS Management Console from now on; the rest of the login process remains the same.

To begin with, let's talk a bit about permissions first. We already used them during the creation of our users, but what actually are permissions and what are their uses?

Permissions provide you with access to and control of various AWS resources. They are also responsible for controlling actions that you can perform on the resources. By default, when you create an IAM user, the user starts as a blank slate, no keys, and no permissions at all. It is your responsibility to assign the users keys and the necessary permissions, which can range from simple novice tasks such as listing resources to creating, updating, and deleting resources, and so on.

Permissions can be classified into two main classes, each briefly explained here:

Not clear, eh? Not a problem. Let's walk through this simple example to get a better feel for it. In our use case, we have users created called Jason, Dave, and Chen. Each of these users can be specified a set of user permissions, for example, Dave can have the ability to list, read, and write on Amazon EC2 service, whereas Chen can only have read permissions on the EC2 instances. Jason, on the other hand, being a manager, can have all admin rights and can perform all actions on any of the AWS services.

Resource-based permissions, on the other hand, are allocated directly to resources, so in this case assume that an S3 bucket (a bucket is a like a storage folder where you dump objects) has been allocated permissions to allow both Dave and Chen read-write access, whereas Jason can read, write, and list objects stored in the bucket:

With permissions covered, let's look at policies in a bit more detail. We briefly used policies during the IAM group creation process, and there you learned that a policy is nothing but a collection of permissions put together in a JSON-formatted document. Policies can contain user-based or resource-based permissions. A single permission forms a statement in a policy, and a single policy can contain multiple statements.

Let's look at a simple policy for our reference:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:DescribeInstances", 
"ec2:DescribeImages"
      ],
"Resource": "arn:aws:iam::012345678910:user/Chen"
}
   ]
}

As you can see, this policy will basically allow the user Chen to only list the EC2 images and instances, in short, simple read-only access. Let's take a closer look at each of this policy's elements:

Now that we have a basic understanding of what a policy is and what it comprises, let's take a quick look at how you can create and assign them to your IAM users and groups using the AWS Management Console.

To create and assign policies, from the AWS Management Console, select the Identity and Access Management option as done before. Next up, select the Policies option from the IAM console's navigation plane. You should see the policy page as shown.

Using this page, you can filter and list existing policies (both inline and manage policies) using the Filter and Search options. You can even create, update, and delete existing policies; attach and detach policies from users and groups using this page. For starters, let's go ahead and create a simple policy for our IAM users. Select the Create Policy option as shown:

This will pop up the Create Policy wizard. Here, you will be provided with three options, briefly explained as follows:

For this scenario, let's go ahead and select the Copy an AWS Managed Policy option. In the Set Permissions page, you can use the Filter and Search bars to search for and select a policy of your choice. In this case, we are selecting Administrator Access Policy created by AWS itself. This policy will ensure that the IAM user attached to it is granted all administrative rights on all the AWS resources. Do note that this is a very crude and high-level permission and is not recommended for use in a production scenario.

In a production scenario, you would have to create individual administrator roles for each of the AWS service that you plan to use and then assign individual users to it as per your requirements. For now; click on the Select option adjoining the AdministratorAccess policy as shown:

This will bring you to the Review Policy page where you can edit and fine tune the policy as per your needs. Note that Policy Document has already been created for your convenience:

In the Review Policy page, you can provide a suitable Policy Name and an optional Description for your new policy. You can even edit the Policy Document if you feel the need to, but in our case, we will leave it as it is. In case you end up editing the Policy Document, then make sure you select the Validate Policy option before you go ahead and deploy the policy.

Once you have completed the changes, select the Create Policy option. With this step, your new custom policy is now ready to be attached to any group or user as you see fit.

To attach a particular policy to a set of users or groups, simply use the Filter and Search bar to find your newly created policy. Once displayed, select the policy you wish to apply by highlighting the checkbox adjoining it, select the Policy Actions drop-down list, and select the Attach option as shown:

This will bring up an Attach Policy page. Here, you can select multiple users and groups at the same time and apply your selected policy to them all in a single go! In our case, we selected the user Jason and the Admin-All-About-Dogs group that we created in our earlier steps. Once you have selected the users and groups, complete the process by selecting the Attach Policy option.