# AWS Identity And Access management

Two termnnology are ther

⚡ Authentication is, if you are allowed to come inside, in terms of AWS are you having proper credential ⚡ using which you can access AWS portal

Authorization, is bascially granting access to particular resources.

There is where we need help of AWS IAM that control the above two . And below are the terminologies that are used when we talk about AWS IAM

📖 USER :: User is bascally a user of real word, we need to register a user in AWS Root account, , its basically an ID which we need to create to share access to AWS

📖 Group :: Group is basically USER Group, so when we add user in AWS account, there will be scenario where we need to add 100’s of user and then share them access / rights accordingly, as per job responsibilties, so instead of giving the access/ rights one by one, it better to create a Group and then add the policy to it.

📖 Roles :: Roles bascially Grants permission to user, application and servicer to do specific operation in AWS

📖 Policy :: AWS IAM Policies is basically that defines who can access the resources and what action they can perform .

📖 Assume role :: When a user "assumes" a role, they are temporarily granted the permissions associated with that role using their own credentials.

📖 Permission Boundy :: IAM Permission boundry limits the permission that users and roles can have

📖 Inline Policy :: IAM Inline Policy is basically , the permission attached to specific user, roles or groups.

*Eg , if User A have access to S3 and User B have access to Ec2 , now user C wants to have both the access, we can also use Inline policy to give access to S3 and EC2 , using ARN of User A & B*

📖 STS:: AKA (Security Token Services ) , The AWS service that facilitates the process of assuming a role by providing temporary security credential

—> STS Policy:: A policy attached to a user or group that specifies whether they are allowed to perform the "AssumeRole" action on a specific IAM role using STS

📌 Tasks :

A. How will you assign a Role to Particular User 🧠

Step 1 ) Create 2 user, admin 1 and admin2, and create a user group, and add both the user in that group

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1740560872797/0afc642a-e872-40ae-889c-a20bc5b659c2.png align="center")

Step 2) Now We must have 2 Account in the root account, eg QA and Stage/dev what ever you choose. How will create 2 account

Step 3 ) You must have 2 email account that is not used in aws

Go to AWS Organization —> ADD AWS Account —> Give the email id —> You will recevie email on respective account —> now sign in to console again , using the same email id you used to ADD AWS ACCOUNT —> Forget Passowrd —> You will get link to reset the passoword —> once reset loign to the account —> Finally theaccount will be added

Now create an OU

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1740561717260/c6ed6fd0-8669-41ba-9a6e-9b38fee8819c.png align="center")

Step 4) Once OU is created you can select the AWS account that you added, can be moved under the OU

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1740561773432/7d572541-3f9d-481a-9641-8c3bdd0bc2d8.png align="center")

Step 5 ) Now Go to the account one by one login and create a role

IAM —> Role —> Create Role —> and give ADMINISTRATOR ACCESS to that role

we need to do on both the account.

Step 6 ) Once done , come to Root account and User group we need to add some policy

User group —> ADD Permission —> Create Inline Policy

```plaintext
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "sts:AssumeRole",
                "sts:GetCallerIdentity",
                "sts:GetSessionToken",
                "sts:DecodeAuthorizationMessage"
            ],
            "Resource":[
                "ARN of role create in 1st account",
                "ARN of role created on 2nd account"
            ] 
        }
    ]
}
```

Step 7 ) Now if you Login to admin 1 user you will see restricted access.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1740557403463/77d4bfa2-d834-472b-9613-c13b2d221f88.png align="center")

so Go to your profile section and do switch role

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1740557447715/ad183f69-4f08-4c9e-85b3-8aac3780af9f.png align="center")

Give below details

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1740557473042/9b8a931f-ca54-463e-8fdc-4cc67d5367e1.png align="center")

Give the account ID of other account which has admin access(eg QA )

Give the Role name

Display name and colour

Step 8 ) Once we login using Switch account, we should be able to create any resources, below we tried to create s3 bucker

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1740557243316/2313c4e5-899a-48a0-9cc9-3ba86b6e8488.png align="center")

Finally we have achieved a way to give user in group, required access using STS