2.2 IAM Labs

IAM accessing is global, you don't need to select a region in your console.

Activate MFA (Multi-Factor Authentication) on your root account

Activate MFA (Multi-Factor Authentication) on your root account to create users and groups and apply policies to your groups and users. The reason is that you don't want to all your employees can access root account and all the resources. You can download a virtual MFA app on your physical device and use it to log in your root account. For example, you can assign a group for your finance department, and another for your HR department. You can also integrate with existing directory account allowing single sign on (interact the resources of other account).

Set up your Users, Groups and Policies.

When you add users, you need to select AWS access type. You can select both of them, programmatic access and AWS management console access.

Then you need to set permissions and select policies for your users, and there are three ways: 1. creating groups for them, 2. copying permissions from existing users, 3. adding permissions to each user directly. When you finish that, you need to download the csv file, because you can only see the key and password information once. Use username and password to access AWS console, and use Access Key ID and Secret Access Key to programmatically interact with AWS through some development tools.

When you created your users, you can create groups and add users to different groups. Then you need to attach policies to groups, and all users in this group will get the permissions.

Finally, you can go to apply an IAM password policy.

Set up roles.

Setting up roles allows your AWS service (EC2, Lambda, etc.) to interact with another. It allows one AWS service to call other AWS services on your behalf. It is just like assign permissions to your user, here you just assign permissions to an AWS service.