Users, Groups & Roles
Tags: devops, cloud, aws
Published: 2022-07-25 06:30:00

Demonstration on how to setup and configure users, groups and roles and differences between them.

In AWS IAM, all three elements are considered as objects.

## Users

A User object can represent a real person who requires access to **operate and maintain** the AWS environment or access the AWS resources or services **programmatically**.

Users are representing an Identity which are used in the authentication process to the AWS account.

## Creating a User

**_Users can be created using AWS Management Console or Programmatically via AWS CLI, IAM HTTP API, Tools for windows powershell._**


- **Creating user name which can be upto 64 characters in length**.

![Creation Page](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/m4b34liy0jaoq17t2iyh.jpg)

- **Selecting AWS access type**:

![User access type](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lrdjnrwm4gjzyxwt72gb.jpg)

**Programmatic**:
_Enables an access Key Id and Secret access key for the AWS CLI, API, SDK_.
**AWS Management Console** :
_Enables a password that allows users to sign-in to the AWS Management Console_.

- **Set permissions for the user**:

For give access to the user AWS has 3 ways.

- **From user groups**

Add the user to one particular user groups, the permission which are assigned for the groups will automatically applicable for the particular user.

![User permissions](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/n9caa1hf9d5uvbsfel2x.jpg)

- **Add policies directly**

Admin can directly add an existing policies or can create new policies.


![Attach policies to an User](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ejdfh547ojff0mnmobaj.jpg)

- **Adding tags are optional**

- **Reviewing the user**

![Review](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/d1bud3xfzhdipkqbnj86.jpg)

- **After the successful user creation** 

Download the `.csv` file for the access keys and password for the created user.

![Created User](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0r9cn79laczyz3srby8x.jpg)

Admin can send e-mail for the user using send-email link.

## Groups

-> Groups can contain only users and not other groups
**creating group for an user/users:-**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vk7hzzapchi6iqnma0cw.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/yloblmysfea6qblc2jiw.png)

Have to provide the group name and there we can add the users to the group as well if already users exists as below


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8zfwrq3terafmbqstvio.png)

if user didn't exists while creating the group , we can specify the group while user creation.

While creating the group if we have to attach the policies at the group level we can as per the below screenshot.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vaptzfxglilm52zyw372.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/a5kjbdqz7njxnh59sgul.png)

Group has been create by showing the number users and creation time.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/v3tix6oat6n3dtnc7i6y.png)








## Roles

Roles can be assumed by the entities to get the credentials


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/l4tl1i3e6cv87h2dx0se.png)

Most commonly we will do for AWS services and common roles are EC2 and lambda


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8pygb10koe4g1ga2crks.png)

we can create our own policy or can select from exists policies. we have to provide role name and description.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/othzvnntzirp6pjmuogd.png)

The JSON document for the role will be defined in below format.

tags are optional.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/s6iohwwb5vrc4xv1y6p5.png)

The roles has been created.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ns69dfp2xyfs2mp5ui63.png)