Скачать или смотреть Day 23 of 90 Days of Cloud - AWS Access and IAM

Day 23 — Oct 7, 2025 #90daysofcloud — AWS Access & IAM
This day felt like unlocking the front door to AWS — I spent the day making sure only the right people could walk in.

I started as a nervous visitor and left as a tiny gatekeeper who understands identity, permissions, and how to make the cloud safe. I focused on Users, Groups, Roles, and Policies; set up a limited IAM user for day-to-day tasks; enforced MFA; and then connected my laptop to AWS using the CLI — suddenly automation felt possible.

What I learned (topics & services):
IAM core concepts: Users, Groups, Roles, Policies, policy types (AWS managed vs customer managed), inline vs managed policies.
MFA (virtual MFA with authenticator apps).
AWS CLI configuration (aws configure, profiles, region, output format).
Least-privilege principle and role chaining (assume-role).
Practical CLI commands for IAM and STS.

Step-by-step practical tasks I did (how I achieved each task):
Read the IAM overview in the console to refresh basics and note recommended best practices.
Created a new IAM Group called devs-limited with no inline policies initially.
Created User achalugo_dev (programmatic + console access off by default) and added to devs-limited.
Created a Customer Managed Policy JSON limiting S3 and CloudWatch read-only actions and attached it to devs-limited. - -- Example actions: s3:ListBucket, s3:GetObject,cloudwatch:ListMetrics.

Enabled MFA for my root and for the new user: configured a virtual MFA device (Authenticator app) in IAM and recorded the recovery steps.

Created an IAM Role ec2-s3-read with trust relationship for EC2 and attached permissions to access a specific S3 bucket — practiced switching into the role via the console and via sts:AssumeRole.

Installed AWS CLI locally on linux (which I have installed earlier on in this learning journey) through virtualbox and ran aws configure --profile achalugo (entered access key, secret key, default region eu-west-1, output json).

Tested CLI: aws iam get-user --profile achalugo, aws sts get-caller-identity, aws iam list-groups-for-user --user-name achalugo_dev.

Rotated a test access key and practiced revoking it in IAM.
#90daysofcloud #AWS #IAM #CloudSecurity #AWSCli #InfoSec #techwithannuvere