Assigning IAM policies to a user for specific permissions

Introduction

In this lesson, we will learn how to assign IAM policies to a user for specific permissions. IAM (Identity and Access Management) policies are used to define permissions for users, groups, and roles in AWS. By assigning IAM policies to a user, you can control what actions they can perform on AWS resources.

We will explore two practical approaches to assigning IAM policies: using AWS CDK with Typescript and using AWS CLI commands. Both methods are commonly used in real-world scenarios and provide flexibility in managing IAM policies.

Using AWS CDK with Typescript

AWS CDK (Cloud Development Kit) is a tool that allows you to define infrastructure as code using programming languages such as Typescript. With AWS CDK, you can create and manage AWS resources, including IAM policies, in a scalable and efficient manner.

Step 1: Set up your AWS CDK project

First, make sure you have AWS CDK installed on your machine. You can install it using npm:

npm install -g aws-cdk

Next, create a new AWS CDK project using the following command:

cdk init app --language typescript

Step 2: Define an IAM policy

In your AWS CDK project, create a new Typescript file (e.g., iam-policy.ts) and define an IAM policy using the Policy class from the @aws-cdk/aws-iam package. Here’s an example IAM policy that allows read-only access to S3 buckets:

import { Policy, PolicyStatement, Effect } from '@aws-cdk/aws-iam';

const s3ReadOnlyPolicy = new Policy(this, 'S3ReadOnlyPolicy', {
  statements: [
    new PolicyStatement({
      effect: Effect.ALLOW,
      actions: ['s3:GetObject'],
      resources: ['arn:aws:s3:::my-bucket/*'],
    }),
  ],
});

Step 3: Assign the IAM policy to a user

To assign the IAM policy to a user, you can use the attachInlinePolicy method of the User class from the @aws-cdk/aws-iam package. Here’s an example of how to assign the s3ReadOnlyPolicy to a user named myUser:

import { User } from '@aws-cdk/aws-iam';

const myUser = new User(this, 'MyUser');

myUser.attachInlinePolicy(s3ReadOnlyPolicy);

Step 4: Deploy the AWS CDK stack

Finally, deploy your AWS CDK stack using the following command:

cdk deploy

Using AWS CLI commands

AWS CLI (Command Line Interface) is a powerful tool that allows you to interact with AWS services from the command line. You can use AWS CLI commands to assign IAM policies to users, groups, and roles with ease.

Step 1: Install and configure AWS CLI

If you haven’t already, install AWS CLI on your machine and configure it with your AWS credentials. You can install AWS CLI using pip:

pip install awscli

Then, configure AWS CLI with your AWS credentials:

aws configure

Step 2: Create an IAM policy

To create an IAM policy using AWS CLI, you can use the create-policy command. Here’s an example IAM policy JSON file (s3-read-only-policy.json) that allows read-only access to S3 buckets:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

Create the IAM policy using the following command:

aws iam create-policy --policy-name s3-read-only-policy --policy-document file://s3-read-only-policy.json

Step 3: Attach the IAM policy to a user

To attach the IAM policy to a user using AWS CLI, you can use the attach-user-policy command. Here’s an example of how to attach the s3-read-only-policy to a user named myUser:

aws iam attach-user-policy --user-name myUser --policy-arn arn:aws:iam::123456789012:policy/s3-read-only-policy

Conclusion

In this lesson, we learned how to assign IAM policies to a user for specific permissions using AWS CDK with Typescript and AWS CLI commands. By following the practical examples provided, you can effectively manage IAM policies and control access to AWS resources for your users. Key learnings from this lesson include:

How to define an IAM policy using AWS CDK with Typescript
How to assign an IAM policy to a user using AWS CDK with Typescript
How to create an IAM policy using AWS CLI commands
How to attach an IAM policy to a user using AWS CLI commands

By mastering these techniques, you can enhance the security and manageability of your AWS environment. Happy coding!

Lessons