|
| 1 | +--- |
| 2 | +title: aws iam > create user via cli |
| 3 | +categories: aws |
| 4 | +--- |
| 5 | + |
| 6 | +Hey all, :wave: we shall see the following in this post: :scroll: |
| 7 | +- Create a group |
| 8 | +- Attach a policy :writing_hand: to the group |
| 9 | +- Create user |
| 10 | +- Add the user to the group |
| 11 | +- Generate access key for the user |
| 12 | + |
| 13 | +## AWS CLI |
| 14 | +Ensure you have installed the [aws cli](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html). Once installed, set up the credentials and configuration similar to the ones below. |
| 15 | + |
| 16 | +Credentials. |
| 17 | +``` |
| 18 | +$ cat ~/.aws/credentials |
| 19 | +[default] |
| 20 | +aws_access_key_id=<aws_access_key_id> |
| 21 | +aws_secret_access_key=<aws_secret_access_key> |
| 22 | +``` |
| 23 | + |
| 24 | +Configuration. |
| 25 | +``` |
| 26 | +$ cat ~/.aws/config |
| 27 | +[default] |
| 28 | +region = us-east-2 |
| 29 | +``` |
| 30 | + |
| 31 | +## Create group |
| 32 | +Let's create a group with the name developers-group. |
| 33 | +``` |
| 34 | +$ aws iam create-group --group-name developers-group |
| 35 | +{ |
| 36 | + "Group": { |
| 37 | + "Path": "/", |
| 38 | + "CreateDate": "2021-12-05T09:40:24Z", |
| 39 | + "GroupId": "<GroupId>", |
| 40 | + "Arn": "arn:aws:iam::<AccountId>:group/developers-group", |
| 41 | + "GroupName": "developers-group" |
| 42 | + } |
| 43 | +} |
| 44 | +``` |
| 45 | + |
| 46 | +## List polices |
| 47 | +There are several built in policies in AWS, that avoids the need of creating custom polcies in most cases, let's try to retrieve policies associated with EC2. Note that I have used [jq](https://stedolan.github.io/jq/download/) for parsing JSON. |
| 48 | + |
| 49 | +``` |
| 50 | +$ aws iam list-policies | jq '.Policies[] | select(.PolicyName | contains ("EC2")) | .Arn' |
| 51 | +"arn:aws:iam::aws:policy/AmazonEC2FullAccess" |
| 52 | +"arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM" |
| 53 | +"arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforAWSCodeDeploy" |
| 54 | +"arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess" |
| 55 | +"arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly" |
| 56 | +"arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceforEC2Role" |
| 57 | +"arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess" |
| 58 | +"arn:aws:iam::aws:policy/aws-service-role/AWSEC2SpotFleetServiceRolePolicy" |
| 59 | +"arn:aws:iam::aws:policy/service-role/AmazonEC2SpotFleetAutoscaleRole" |
| 60 | +"arn:aws:iam::aws:policy/CloudWatchActionsEC2Access" |
| 61 | +"arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceEventsRole" |
| 62 | +"arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceAutoscaleRole" |
| 63 | +"arn:aws:iam::aws:policy/aws-service-role/AWSAutoScalingPlansEC2AutoScalingPolicy" |
| 64 | +"arn:aws:iam::aws:policy/aws-service-role/AWSEC2SpotServiceRolePolicy" |
| 65 | +"arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforDataPipelineRole" |
| 66 | +"arn:aws:iam::aws:policy/service-role/AmazonEC2SpotFleetTaggingRole" |
| 67 | +"arn:aws:iam::aws:policy/aws-service-role/AWSServiceRoleForEC2ScheduledInstances" |
| 68 | +"arn:aws:iam::aws:policy/aws-service-role/AWSEC2FleetServiceRolePolicy" |
| 69 | +"arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPowerUser" |
| 70 | +"arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role" |
| 71 | +"arn:aws:iam::aws:policy/aws-service-role/AWSApplicationAutoscalingEC2SpotFleetRequestPolicy" |
| 72 | +"arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole" |
| 73 | +"arn:aws:iam::aws:policy/AWSElasticBeanstalkCustomPlatformforEC2Role" |
| 74 | +"arn:aws:iam::aws:policy/EC2InstanceProfileForImageBuilderECRContainerBuilds" |
| 75 | +"arn:aws:iam::aws:policy/AmazonEC2RolePolicyForLaunchWizard" |
| 76 | +"arn:aws:iam::aws:policy/EC2InstanceProfileForImageBuilder" |
| 77 | +"arn:aws:iam::aws:policy/aws-service-role/AWSEC2CapacityReservationFleetRolePolicy" |
| 78 | +"arn:aws:iam::aws:policy/aws-service-role/EC2FleetTimeShiftableServiceRolePolicy" |
| 79 | +"arn:aws:iam::aws:policy/AWSOpsWorksRegisterCLI_EC2" |
| 80 | +"arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforAWSCodeDeployLimited" |
| 81 | +"arn:aws:iam::aws:policy/AWSApplicationMigrationEC2Access" |
| 82 | +"arn:aws:iam::aws:policy/EC2InstanceConnect" |
| 83 | +``` |
| 84 | + |
| 85 | +Now let's try to find policies related to S3. :bucket: |
| 86 | +``` |
| 87 | +$ aws iam list-policies | jq '.Policies[] | select(.PolicyName | contains ("S3")) | .Arn' |
| 88 | +"arn:aws:iam::aws:policy/service-role/AmazonDMSRedshiftS3Role" |
| 89 | +"arn:aws:iam::aws:policy/AmazonS3FullAccess" |
| 90 | +"arn:aws:iam::aws:policy/service-role/QuickSightAccessForS3StorageManagementAnalyticsReadOnly" |
| 91 | +"arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess" |
| 92 | +"arn:aws:iam::aws:policy/AmazonS3OutpostsFullAccess" |
| 93 | +"arn:aws:iam::aws:policy/aws-service-role/S3StorageLensServiceRolePolicy" |
| 94 | +"arn:aws:iam::aws:policy/aws-service-role/IVSRecordToS3" |
| 95 | +"arn:aws:iam::aws:policy/service-role/AmazonS3ObjectLambdaExecutionRolePolicy" |
| 96 | +"arn:aws:iam::aws:policy/AmazonS3OutpostsReadOnlyAccess" |
| 97 | +``` |
| 98 | + |
| 99 | +## Attach policy |
| 100 | +Attach a relevant EC2 policy to the group. |
| 101 | +``` |
| 102 | +$ aws iam attach-group-policy --group-name developers-group --policy-arn "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess" |
| 103 | +``` |
| 104 | + |
| 105 | +Now let's add a second policy to the group, this time related to S3. |
| 106 | +``` |
| 107 | +$ aws iam attach-group-policy --group-name developers-group --policy-arn "arn:aws:iam::aws:policy/AmazonS3FullAccess" |
| 108 | +``` |
| 109 | + |
| 110 | +So, the group now has read only access to EC2 and full access to S3. |
| 111 | + |
| 112 | +## Create user |
| 113 | +Create a user with the name developer1. |
| 114 | +``` |
| 115 | +$ aws iam create-user --user-name developer1 |
| 116 | +{ |
| 117 | + "User": { |
| 118 | + "Path": "/", |
| 119 | + "UserName": "developer1", |
| 120 | + "UserId": "<UserId>", |
| 121 | + "Arn": "arn:aws:iam::<AccountId>:user/developer1", |
| 122 | + "CreateDate": "2021-12-05T10:02:02+00:00" |
| 123 | + } |
| 124 | +} |
| 125 | +``` |
| 126 | + |
| 127 | +## Add user |
| 128 | +Add the developer1 user to developers-group, so that the user inherits the policies attached to the group. |
| 129 | +``` |
| 130 | +$ aws iam add-user-to-group --group-name developers-group --user-name developer1 |
| 131 | +``` |
| 132 | + |
| 133 | +Nice they are asking for group name and user name here, unlike ARNs in cases where the names are not unique. |
| 134 | + |
| 135 | +## Access key |
| 136 | +Generate access key for the user, and share it with the user, so that they can setup the credentials for AWS CLI, just like you did. |
| 137 | +``` |
| 138 | +$ aws iam create-access-key --user-name developer1 |
| 139 | +{ |
| 140 | + "AccessKey": { |
| 141 | + "UserName": "developer1", |
| 142 | + "AccessKeyId": "<AccessKeyId>", |
| 143 | + "Status": "Active", |
| 144 | + "SecretAccessKey": "<SecretAccessKey>", |
| 145 | + "CreateDate": "2021-12-05T10:14:20+00:00" |
| 146 | + } |
| 147 | +} |
| 148 | +``` |
| 149 | + |
| 150 | +## Verify |
| 151 | +List the groups, the user belongs to. |
| 152 | +``` |
| 153 | +$ aws iam list-groups-for-user --user-name developer1 |
| 154 | +{ |
| 155 | + "Groups": [ |
| 156 | + { |
| 157 | + "Path": "/", |
| 158 | + "GroupName": "developers-group", |
| 159 | + "GroupId": "<GroupId>", |
| 160 | + "Arn": "arn:aws:iam::<AccountId>:group/developers-group", |
| 161 | + "CreateDate": "2021-12-05T09:40:24+00:00" |
| 162 | + } |
| 163 | + ] |
| 164 | +} |
| 165 | +``` |
| 166 | + |
| 167 | +List the polices, the group is attached to. |
| 168 | +``` |
| 169 | +{ |
| 170 | + "AttachedPolicies": [ |
| 171 | + { |
| 172 | + "PolicyName": "AmazonS3FullAccess", |
| 173 | + "PolicyArn": "arn:aws:iam::aws:policy/AmazonS3FullAccess" |
| 174 | + }, |
| 175 | + { |
| 176 | + "PolicyName": "AmazonEC2ReadOnlyAccess", |
| 177 | + "PolicyArn": "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess" |
| 178 | + } |
| 179 | + ] |
| 180 | +} |
| 181 | +``` |
| 182 | + |
| 183 | +This way you can create different groups as required, attach relevant policies to the group, and add appropriate users to each group. And finally don't forget to generate the access key for each user, and share it with them, with out which they will not be able to login via the AWS CLI. Thank you !!! :thumbsup: |
| 184 | + |
| 185 | +--end-of-post-- |
0 commit comments