Amazon Identity and Access Management (IAM) is a web service that allows one to manage users and groups, and assign permissions to them as needed to improve the security of one's Amazon Web Services (AWS) account. By using IAM you can easily consolidate billing, make key rotation easier, and limit the damage that a compromised set of credentials can cause. The objective of this primer is to familiarize the reader with IAM's functionality and terminology. For more detailed documentation, see the AWS website. For help with Fedora on EC2, ask the Fedora Cloud SIG.
IAM Concepts
IAM involves several types of entities as well as permissions that you grant to entities in your AWS account.
Accounts
When you sign up for AWS you create an account, an entity that centrally controls all the resources that you create and pays for all of its activity. An account is similar to the superuser on a regular computer in that it always has permission to use all of AWS's functionality. It also has a password that allows you to access the AWS website and view billing information.
Users
A user is an entity that represents a person, a computer, or a program that can interact with AWS in the same manner as an account. Unlike an account, however, you can restrict a user to a subset of all of AWS's functionality.
Security Credentials
Both accounts and users use security credentials to interact with AWS programmatically. Tools use security credentials to cryptographically sign the messages they send to AWS so they can prove who they represent. Whether a set of credentials belongs to a user or an account, the ways in which they are used are identical.
There are three types of security credentials:
Access Keys
Access keys come in pairs: a secret access key and an access key ID. Most tools require this type of credentials.
X.509 Certificates
An X.509 Certificate (the same type of certificate used by web servers everywhere) comes with a matching private key. Whether or not this type of credential is necessary depends on the tools you use.
Login Profiles
A login profile is a username and password that allow a user to log into the AWS website. Since accounts are always associated with their own passwords they cannot have login profiles.
Groups
A group is a collection of users. By sorting users into groups you can simplify user management. A given user can belong to more than one group.
Resources
A resource is an object in an AWS service that you can interact with, such as a bucket or object in Amazon S3. Resources typically have both human-readable names (e.g. mybucket) and unique, machine-readable names.
Policies
A policy states that a user or group is allowed to access a set of resources or run a set of commands in AWS. For instance, a policy may state that the S3 bucket called mybucket should be readable by the users alice and bob. Alternatively, a permission may state that the user alice has permission to run instances in Amazon EC2.
Policies can deny access instead of allowing access. A policy that explicitly denies access always takes precedence over a policy that allows access.
Policies are discussed in detail in Amazon's IAM documentation.
Why Use IAM?
Using account credentials for everything is akin to logging into a computer as the root user for daily work. While it may be easier, doing so opens you up to unnecessary risks in the event of a mistake of a breach of security.
Some examples of when IAM is useful include:
- Limiting the effects of errors in automated scripts
- Providing limited, short-term accounts for a Fedora test day inside of EC2
Getting Started with IAM
Most of commands in this tutorial require version 2 or later of the euca2ools command line suite. A pre-release of version 2.0 is available from http://repos.fedorapeople.org/repos/gholms/cloud/.
Get Your Account Details
One can interact with IAM through either a web-based management console or via euca2ools, a suite of command line tools designed for services like IAM. This tutorial will focus on using IAM with euca2ools at the command line. This tutorial also assumes that you already have an active AWS account.
To use the command line tools you first need to obtain access keys for your account. You can find them by going to the AWS management console on the web, clicking your name on the top, followed by
Security Credentials, and scrolling down to the section titled Access Credentials. Make note of the Access Key ID and the Secret Access Key that appears beside it. Both of them should be long sets of alphanumeric characters. Create a file called .iamrc in your home directory that contains those keys in this format:
AWSAccessKeyId=your_access_key_id AWSSecretKey=your_secret_key
Since euca2ools is designed to work with all AWS-compatible clouds, not just AWS itself, it needs to know which cloud to contact. Create a file called .eucarc in your home directory with the following content to point it toward AWS:
export AWS_CREDENTIAL_FILE=~/.iamrc export EC2_URL=https://ec2.amazonaws.com/ export S3_URL=https://s3.amazonaws.com/ export EUARE_URL=https://iam.amazonaws.com/ source "$AWS_CREDENTIAL_FILE" export EC2_ACCESS_KEY=$AWSAccessKeyId export EC2_SECRET_KEY=$AWSSecretKey export AWS_ACCESS_KEY=$AWSAccessKeyId export AWS_SECRET_ACCESS_KEY=$AWSSecretKey
Finally, add these settings to your shell's environment by running:
$ source ~/.eucarc
Do Initial Setup
Install the Command Line Tools
Install the euca2ools package. To do so with yum, run:
# yum install euca2ools
Create an Administrative Group
Amazon recommends using account credentials as little as possible. You can avoid using account credentials by creating a group of users with administrative privileges. First create a group called administrators:
$ euare-groupcreate -g administrators
If you wish, you can show a list of your groups to check that the command worked:
$ euare-grouplistbypath arn:aws:iam::123456789012:group/administrators
Add a Policy to the Administrative Group
Then add a policy to the administrators group that allows its members to perform all actions in AWS.
You can add such a policy with the following command:
$ euare-groupaddpolicy -p admin-root -g administrators -e Allow -a "*" -r "*" -o
Taken literally, this command has six parts:
euare-groupaddpolicy |
Add a policy to a group... |
-p admin-root |
called admin-root...
|
-g administrators |
to group administrators...
|
-e Allow |
that will Allow...
|
-a "*" |
all actions... |
-r "*" |
on all resources. |
While IAM policies are typically written in a machine-readable format called JSON, this policy is simple enough that it is unnecessary. Regardless of their complexity, IAM policies are always broken into sections in the manner shown above.
Create an Administrative User
Next, create a user for day-to-day administrative work and add that user to the administrators group.
$ euare-usercreate -u alice $ euare-groupadduser -g administrators -u alice
Switch to the Administrative User
To start running commands as the new user you need to create an access key for that user:
$ euare-useraddkey -u alice
This command displays two lines of text. The first is the user's access key ID, while the second is the user's secret key. Open ~/.iamrc with your favorite editor, replace the account credentials you added earlier with the user's credentials you just created, and then switch euca2ools over to using those.
$ euare-useraddkey -u alice $ ed ~/.iamrc $ source ~/.eucarc