Learn to use AWS IAM in command line
Published: 2023-05-10 20:33:05

If you landed here by parachute and don't know how to configure LocalStack to simulate an AWS environment, follow this post: [Simulating AWS CLI with LocalStack](https://dev.to/israellopes/simulating-aws-cli-with-localstack-42kb)

What is IAM?

IAM (Identity and Access Management) is an AWS service that allows you to securely manage access to AWS resources and services. It provides granular control over permissions and access policies for users, groups, roles, and services within your AWS account.

IAM lets you create and manage identities (users, groups, and roles) and assign
permissions specific to those identities. Some of the main features and
IAM features include:

1. User Management: You can create IAM users and provide credentials
login for them. Each user will have a set of unique credentials
to authenticate to the AWS account.

2. Groups: You can organize users into logical groups and assign permissions at the group level.
This simplifies permission administration as you can add or remove users from
a group and the permissions will be applied automatically.

3. IAM Roles: IAM roles allow you to grant temporary permissions to services and
AWS applications. This is useful when you want to allow a service to access
other resources in your account on your behalf, without having to share access credentials.

4. IAM Policies: IAM policies are JSON documents that define permissions for
users, groups, and roles. You can create custom policies to meet requirements
access specifics and assign those policies to identities.

5. Integration with Other Services: IAM integrates with many AWS services, allowing you to
control access to specific features in those services. For example, you can define policies
access to S3 buckets, EC2 instances, SQS queues and many others.

## Creating user in IAM

Now let's learn how to create our first user in IAM, just follow the command below:

``aws iam create-user --user-name <username>``

We can now list our user: ``aws iam list-users``

After the user has been created, we can now grant access to him. Here's an example:

``aws iam attach-user-policy --user-name <username> --policy-arn arn:aws:iam::aws:policy/MyPolicy``

Replace ``<username>`` with the username you created and
``arn:aws:iam::aws:policy/MyPolicy`` by the ARN (Amazon Resource Name) of the
policy you want to associate.

Below is a list of the most common policies to apply:

- AmazonS3FullAccess: Grants full access to Amazon S3 storage services.
  - AmazonEC2FullAccess: Grants full access to Amazon EC2(Elastic Compute Cloud) services.
  - AmazonDynamoDBFullAccess: Grants full access to Amazon DynamoDB services.
  - AmazonRDSFullAccess: Grants full access to Amazon RDS (Relational Database Service) services.
  - AmazonSQSFullAccess: Grants full access to Amazon SQS (Simple Queue Service) services.
  - AmazonSNSFullAccess: Grants full access to Amazon SNS (Simple Notification Service) services.
  - AWSLambdaFullAccess: Grants full access to AWS Lambda services.
  - AWSReadOnlyAccess: Grants read-only access to a wide range of AWS services.

If you want to see more policies, access the link [politicas](https://docs.aws.amazon.com/pt_br/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies)
Continuing, I want to give access to the user Luis to have access to Dynamo, in this case:

``aws iam attach-user-policy --user-name Luis --policy-arn arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess``

Now let's list the accesses of our user Luis:

``aws iam list-attached-user-policies --user-name Luis``

It will return the following:

```
{
    "AttachedPolicies": [
        {
            "PolicyName": "AmazonDynamoDBFullAccess",
            "PolicyArn": "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess"
        }
    ]
}
```

I want to remove the access that I was given to the user, how do you do it now?
Just follow the example, let's remove the access we just gave Luis:

``aws iam detach-user-policy --user-name Luis --policy-arn arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess``

Listing the user accesses, it should return:

```
{
    "AttachedPolicies": []
}
```

This way, we just detach ***AmazonDynamoDBFullAccess*** access to the user Luis.
We move on now.

Now let's delete the user Luis:

``aws iam delete-user --user-name Luis``

## Finish

We learned here how to create users, set access policies, remove them and delete users.
There are more features that IAM can offer, but I've only presented the basics.

<br />

[![Texto alternativo da imagem](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ds4alkts3uxq0dsco0nv.png)](https://www.linkedin.com/in/israel-lopes-419a32189)