Lab 05 — IAM Users, Groups & Policies

1. Search for IAM and click it
2. Left sidebar → Users → Create user
3. User name: dev-user
4. Check Provide user access to the AWS Management Console
5. Select I want to create an IAM user
6. Console password: Custom password → enter a password
7. Uncheck “Users must create a new password at next sign-in”
8. Click Next → skip permissions for now → Create user
9. Repeat to create a second user: readonly-user

1. Left sidebar → User groups → Create group
2. Group name: Developers
3. Add user: dev-user
4. Click Create group
5. Create a second group: ReadOnly → add readonly-user

Instead of using broad managed policies, you will write a JSON policy that grants only the exact permissions needed.

1. Left sidebar → Policies → Create policy
2. Click JSON tab and paste the policy below
3. Click Next → Policy name: S3ReadOnlyAccess-Custom → Create policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::*",
        "arn:aws:s3:::*/*"
      ]
    }
  ]
}

1. Left sidebar → User groups → click Developers
2. Permissions tab → Add permissions → Attach policies
3. Search for AmazonEC2FullAccess → attach it
4. Also attach AmazonS3FullAccess
5. Click ReadOnly group → attach S3ReadOnlyAccess-Custom

1. Left sidebar → Roles → Create role
2. Trusted entity: AWS service → Use case: EC2 → Next
3. Attach policy: AmazonS3ReadOnlyAccess
4. Role name: EC2-S3-ReadOnly-Role → Create role

1. Go to IAM → Users → readonly-user
2. Copy the Console sign-in URL
3. Open a private/incognito browser window and paste the URL
4. Sign in with username readonly-user and the password you set
5. Try to navigate to EC2 — you should see “You are not authorized”
6. Try to navigate to S3 — you should be able to list buckets (read-only)
7. Try to create an S3 bucket — should fail with an access denied error
8. Close the incognito window and sign back in with your admin account