This lesson's interactive features are locked, please to keep using them

IAM Groups

While inline policies are attached directly to a single user, the preferred way to manage permissions in AWS is to create groups and give them the policies (sometimes called customer-managed policies).

This DRYs up your permissions management and makes it much easier to ensure that everyone has only the access levels they need.

Let's convert our inline policy into a customer-managed policy, then attach it to a group.

Assignment

PatientPing's CISO has "thoughts" about our inline policies. Per last week's security review: no more inline policies on users.

Create a customer-managed policy patientping-ec2-readonly and a group patientping-ec2-readers. Attach the policy to the group, add patientping-admin-vinny to the group, and remove the inline policy from the user.

Cost check: Creating IAM groups and policies is free; costs arise from service usage.

Create a customer-managed policy patientping-ec2-readonly:
1. Navigate to "IAM" → "Policies" in the AWS Console.
2. Click "Create policy."
3. In the policy editor, switch to JSON input, delete all the starter text, and paste the following:
```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["ec2:Describe*"],
      "Resource": "*"
    }
  ]
}
```
4. Click "Next" at the bottom.
5. Name the policy patientping-ec2-readonly, then finalize by clicking "Create policy."
Create a user group and attach the policy:
1. Navigate to "IAM" → "User groups" in the AWS Console.
2. Click the "Create group" button at the top right.
3. Name the new group patientping-ec2-readers.
4. Attach the patientping-ec2-readonly policy (use the search field to find it).
5. Click "Create group."
Add patientping-admin-vinny to the group:
1. Navigate to "IAM" → "User groups" in the AWS Console.
2. Select the patientping-ec2-readers group and go to its "Users" tab.
3. Click "Add users," select patientping-admin-vinny, and click the "Add users" button.
Remove the inline policy from patientping-admin-vinny:
1. Navigate to "IAM" → "Users" in the AWS Console.
2. Select patientping-admin-vinny and go to the "Permissions" tab.
3. Under "Permissions policies," select the inline policy (it should be clear which one that is).
4. Click "Remove" and confirm.

Run and submit the CLI tests.

Tip

For CLI users, here's how to create IAM groups, policies, and manage group membership:

# Create a customer-managed policy
aws iam create-policy --policy-name POLICY-NAME --policy-document file://POLICY-FILE.json

# Create a group
aws iam create-group --group-name GROUP-NAME

# Attach policy to group
aws iam attach-group-policy --group-name GROUP-NAME --policy-arn POLICY-ARN

# Add user to group
aws iam add-user-to-group --group-name GROUP-NAME --user-name USER-NAME

# Remove the inline policy from the user
aws iam delete-user-policy --user-name USER-NAME --policy-name POLICY-NAME