From Console to CLI: Building a Secure AWS Identity with IAM

Step A1 — Identify Regions and AZs

1. Log in to the AWS Console.
2. Click the Region selector (top-right) and browse the list.
3. Note 3 Regions and codes (e.g., us-east-1, eu-west-1, ap-southeast-1).
4. Navigate to EC2 Console → EC2 Dashboard.
5. Under Service Health, observe AZ names like us-east-1a.

✅ Checkpoint A1: You can name 3 Regions, their codes, and at least 2 AZs.

Step A2 — Observe Edge Locations and Local Zones

1. Open CloudFront Console → Distributions (do not create one).
2. Visit the global infrastructure map: aws.amazon.com/about-aws/global-infrastructure.
3. Identify 3 Edge Locations near you and 1 Local Zone (if available).

✅ Checkpoint A2: Explain Edge Location vs Availability Zone in one sentence.

Step B1 — Create an IAM Group

1. IAM Console → User groups → Create group.
2. Group name: foglamp-developers.
3. Skip policies → Create group.

Step B2 — Create a Least-Privilege Policy

IAM → Policies → Create policy → JSON tab. Paste:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListAllBuckets",
      "Effect": "Allow",
      "Action": ["s3:ListAllMyBuckets"],
      "Resource": "*"
    },
    {
      "Sid": "ReadOnlyOnFogLampBucket",
      "Effect": "Allow",
      "Action": ["s3:ListBucket", "s3:GetObject", "s3:GetObjectVersion"],
      "Resource": [
        "arn:aws:s3:::foglamp-lab-<yourname>",
        "arn:aws:s3:::foglamp-lab-<yourname>/*"
      ]
    }
  ]
}

Replace <yourname>. Name: FogLampS3ReadOnly. Create.

✅ Checkpoint B2: Policy exists with 0 attachments.

Step B3 — Attach Policy to Group

1. IAM → User groups → foglamp-developers → Add permissions → Attach policies.
2. Search FogLampS3ReadOnly → select → Add permissions.

Step B4 — Create an IAM User

1. IAM → Users → Create user.
2. Username: dev-junior.
3. Enable console access → custom password → uncheck "must reset".
4. Add to group foglamp-developers → Create.
5. Download the .csv with credentials and store securely.

✅ Checkpoint B4: User listed as member of the group.

Step B5 — Enforce an IAM Password Policy

IAM → Account settings → Password policy → Edit:

• Minimum length: 12
• Require uppercase, lowercase, number, symbol: Yes
• Password expiration: 90 days
• Prevent reuse: 5

Step B6 — Enable MFA for dev-junior

1. IAM → Users → dev-junior → Security credentials → Assign MFA device.
2. Name: dev-junior-phone.
3. Choose Authenticator app → scan QR.
4. Enter two consecutive MFA codes → Add MFA.

✅ Checkpoint B6: MFA device listed as active.

Step C1 — Create Access Keys for dev-junior

1. IAM → Users → dev-junior → Security credentials → Create access key.
2. Use case: Command Line Interface (CLI) → acknowledge → Create.
3. Download CSV. Never share or commit these keys.

Step C2 — Configure a Named CLI Profile

aws configure --profile foglamp-dev

Provide:

AWS Access Key ID [None]: <paste access key>
AWS Secret Access Key [None]: <paste secret key>
Default region name [None]: us-east-1
Default output format [None]: json

Verify:

ls ~/.aws
cat ~/.aws/config

Step C3 — Verify Identity

aws sts get-caller-identity --profile foglamp-dev

Expected output:

{
  "UserId": "AIDA...",
  "Account": "123456789012",
  "Arn": "arn:aws:iam::123456789012:user/dev-junior"
}

✅ Checkpoint C3: ARN ends with user/dev-junior.

Step C4 — List Regions via CLI

aws ec2 describe-regions --profile foglamp-dev \
  --query "Regions[].RegionName" --output table

Step C5 — List Availability Zones

aws ec2 describe-availability-zones --profile foglamp-dev \
  --region us-east-1 \
  --query "AvailabilityZones[].ZoneName" --output table

Expected output: us-east-1a, us-east-1b, etc.

Step D1 — Create a Bucket (as admin)

Console: S3 → Create bucket → Name foglamp-lab-<yourname> → Region us-east-1 → Block all public access → Create.

Step D2 — Upload a Test Object (as admin)

echo "FogLamp test file" > test.txt
aws s3 cp test.txt s3://foglamp-lab-<yourname>/test.txt --profile default

Step D3 — Read the Object as dev-junior

aws s3 ls s3://foglamp-lab-<yourname>/ --profile foglamp-dev
aws s3 cp s3://foglamp-lab-<yourname>/test.txt downloaded.txt --profile foglamp-dev
cat downloaded.txt

Expected: FogLamp test file.

Step D4 — Verify Least Privilege (Denied Action)

aws s3 cp test.txt s3://foglamp-lab-<yourname>/test2.txt --profile foglamp-dev

Expected output:

upload failed: ./test.txt to s3://foglamp-lab-<yourname>/test2.txt
An error occurred (AccessDenied) when calling the PutObject operation: Access Denied

✅ Checkpoint D4: AccessDenied confirms least privilege works.

Step E1 — Create a Role for EC2

1. IAM → Roles → Create role.
2. Trusted entity: AWS service → EC2.
3. Attach policy: AmazonS3ReadOnlyAccess.
4. Role name: FogLampEC2S3ReadOnly → Create.

Step E2 — Inspect the Trust Policy

aws iam get-role --role-name FogLampEC2S3ReadOnly \
  --query "Role.AssumeRolePolicyDocument" --output json

Why this matters: EC2 assumes this role and receives temporary credentials — no access keys stored on the instance.