4.14 Using IAM Roles with EC2

Identity Access Management Roles Lab

Using user's credentials is not always safe, they are stored locally in your EC2 instance.

Steps:

• Go to IAM, and go to Roles.

• Create a new role:

  • Role type could be selected as Amazon EC2.

  • For attach policy, if we take S3 as an example, we can choose AmazonS3FullAccess.

  • Set role name and review.

• If you create a role globally, you cannot change its region. All roles are global.

• Go to create a new EC2 instance. When you configure instance details, you can select a proper IAM role. Then configure security group, select a proper security group. Review and launch.

• You can go to your EC2 instance and click Actions -> Instance Settings -> Attach/Replace IAM role to attach or replace a IAM role to your EC2 instance, so it is possible to attach a role to a running EC2 instance.

For now, when you login to EC2 instance and run "aws s3 ls", you will not need to type in your credentials anymore, because you already have the role of AmazonS3FullAccess. Role is really secure, and you don't need to store your credentials locally, if your credentials change, you wouldn't need to log into your EC2 instances and update those credentials.

You can go to "cd ~" and "cd .aws", you will find .aws directory does not exists. You can run "aws configure", then you just press enter and leave all of the inputs blank. Then you run "cd .aws", you will find a config file, but you cannot find a credentials file. The only thing stored in config file is your region, no credentials data. In this way, you don't need to worry when your EC2 instances got compromised, and you don't need to delete your access key Id and secret access key or change it across all of your EC2 instances.