Creating your first IAM admin user and User group in your AWS account
Tags: tutorial, aws, machinelearning, iam
Published: 2022-02-13 12:25:00

## What is IAM ?

AWS Identity and access management (IAM) was introduced to AWS accounts in September 1 2020. IAM provides controlled access to AWS resources for IAM users, groups of users and roles to AWS services.

IAM is a free service provided by AWS and it can be created from the IAM console.

## How would you use IAM?

IAM provides permission access using the principle of 'least privilege'via IAM Access Analyzer to allow users to have access to only the required AWS services to perform their job role in an organization or function.

IAM policies is used to grant access to AWS services to specify what type of access may be granted in the action table which include the following access levels:

* Read
* Write
* List
* Permission Management


### Reference Architecture

The AWS reference architecture diagram below provides an overview of AWS Identity and Access Management for an IAM user which grants access to AWS services with policy permissions that specify 'Allow'.

![architecture](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/e6zpnag1miotw54tvwqp.png)

For example, under Identity and Access Management (IAM) and the navigation pane Policies, the level of access provided under the AdministratorAccess policy is full access for all AWS services.


![admin policy](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tyene4qym2bcbqapeb5v.png)

The AWS reference architecture diagram below provides an overview of AWS Identity and Access Management with AWS Single Sign-On (SSO):

For example, a startup can use AWS Single Sign-On (SSO) via identity access provider Okta to grant permission via AWS Organization for a group of users (i.e. 3 data analysts). The permissions of the data analysts can be managed for AWS applications such as  such as Amazon S3, Amazon Glue DataBrew, Amazon QuickSight and Amazon Redshift. These group of users will have single click access to their AWS account.


![SSO](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kbz148mrql5rnv7zxotl.png
)

## Important: AWS Root User account - use sparingly

It is best practice not to use your AWS Root User account for a task that is not required but you may use this account to create  administrator access.

The alternative is to create admin access for each new user who have the same level of permissions under an administrator group.

![Root](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4o627k1jvk80w46opcx0.png)

You may need to create admin user access using AWS management console or with programmatic access if you which to test and build production workloads for tasks which may include the following:

* Databases
* Data warehousing
* ETL
* Machine learning
* AI

## Tutorial: How to create your first IAM user and user group

Step 1: Login to the AWS management console using your AWS Root credentials

https://aws.amazon.com/console/


![login](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/375gd6qufbf5fck9ateo.png)

Step 2: Navigate to your AWS Account details and select Account.

Scroll down to 'IAM User and Role Access to Billing Information' and click edit.


![billing](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ckarjbouqm06dqewzug5.png)

Check the box 'IAM access' and click Update.


![Activate IAM](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gh4tm4mq84tk4jrgog5m.png)

Step 4: Navigate to AWS Services and search for IAM to access the IAM console.


![IAM console](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pqpz8ud2sxfuh8h5v65u.png)

Step 5: From the IAM console select Users on the left-handside and  click Add Users


![Add User](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ze0e5ipky5gbebyolt95.png)

Step 6: Under User name type 'Administrator'

Check the box: Password - AWS Management Console access

In Console password, create a custom password

Uncheck the box 'Require password reset'

Click: permissions


![custom password](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5wdzr8dl2jlnrpttskx0.png)


Step 7: Navigate to Users and click 'Add permissions'


![add permissions](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sfyfo9znrgnm9szz25yg.png)

Select 'Add User to Group' and click Create Group


![Add user to group](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/50jxgn2y20x10q696qei.png)

Step 8: Select 'Administrator Access' and then click 'Create group'.


![admin access](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rgpdcjtrtjc1yty31irb.png)

Step 9: Refresh your web browser so you can see the newly created Administrator group that was created under Users group.


![user group created ](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/oud1ed37bdkwszyo12fk.png
)

Under the Administrator group full access is provided to AWS services


![full access](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3plblxejhx1ypboj3z1o.png)

Step 10: Optional: Create a tag to help manage AWS resources

![Tag optional](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8e6t4ijyfv4z9yt8zi3p.png)

![key value](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/npzo6lgm8gfum0kj5lyq.png)

Step 11: Confirmation that new Administrator user has been successfully created

![new user creation](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/eibfdzndr7aare7u4kg5.png)

Details are shown of the Administrator user IAM credentials that can be sent to an email address and also downloaded as a csv file 
for your record keeping to login as an IAM User.


![download csv](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/s84d409hr5zeifa5zsq2.png)

An email displays your new login URL to help you login with your IAM User account credentials.


![email](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7ivuyhrrog7nd70mba37.png)

Step 12: Login to your AWS account using your IAM credentials and password with the dedicated URL link provided from your email


![IAM user](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kh3kkoenn6m5s3l3nzl7.png)

## Reference

* [AWS IAM documentation](https://aws.amazon.com/iam/) 
* [AWS Single Sign-On](https://aws.amazon.com/single-sign-on/)
* [Creating IAM admin user and user group](https://docs.aws.amazon.com/IAM/latest/UserGuide/getting-started_create-admin-group.html)
* [AWS Root User account](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html)
* [Create a tag](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_tags.html)

Happy Learning! 😁

Next Tutorial: Creating a S3 bucket with audio files - Conversational AI part 2