AWS IAM — Hands-On Practical Guide

Sign Up for AWS

1. Open a browser and go to https://aws.amazon.com/free
2. Click Create a Free Account
3. Fill in:
   • Email address: Use a personal email (not work)
   • AWS account name: iam-lab-<your-initials> (e.g., iam-lab-aj)
   • Root user email: Same as above
4. Click Verify email address — AWS will send a verification code
5. Enter the verification code
6. Create a strong password for the root account
7. Choose Business account type (even for personal — required for some features)
8. Fill in your contact information
9. Enter payment information — AWS requires a credit card for verification
   • You will not be charged if you stay within free tier limits
   • A temporary $1 hold may appear for verification
10. Verify your identity via SMS or phone call
11. Choose the Free Tier support plan
12. Click Complete sign-up

Secure the Root Account

The root user has unrestricted access to everything. You will never use the root user for daily work, but you need it for initial setup.

1. After login, go to the IAM Dashboard: https://console.aws.amazon.com/iam/
2. You should see a security alert: “Activate MFA on your root account”
3. Click Add MFA → Activate
4. Choose Authenticator app
5. Scan the QR code with Google Authenticator, Authy, or 1Password
6. Enter two consecutive OTP codes to verify
7. Click Assign

Create Your Admin User

You need a day-to-day admin user with MFA. You will create this as the first IAM user.

1. In the IAM Console, click Users in the left sidebar

2. Click Create user

3. User name: admin

4. ☑ Provide user access to the AWS Management Console

5. ☑ I want to create an IAM user

6. Console password: ☑ Custom password → enter a strong password (e.g., Admin!AWS2026)

7. ☑ Users must create a new password at next sign-in (recommended)

8. Click Next

9. Permissions options: ☑ Add user to group

10. Click Create group

11. Group name: Admins

12. In the policy search box, type AdministratorAccess

13. ☑ Check AdministratorAccess

14. Click Create group

15. Click Next

16. Review: Verify the user has AdministratorAccess via the Admins group

17. Click Create user

18. Success! Copy the Console sign-in URL — it looks like: https://<your-account-id>.signin.aws.amazon.com/console Save this URL — you will use it to log in as admin instead of root.

19. Download the CSV with credentials (optional) or note the password

20. Click Return to users list

21. Click on the admin user

22. Go to the Security credentials tab

23. Under Assign MFA device → Assign MFA

24. Choose Authenticator app → scan QR code → enter two codes → Add

25. Sign out of the root account

Test Admin Access

1. Open a private/incognito browser window
2. Go to the sign-in URL you saved earlier: https://<your-account-id>.signin.aws.amazon.com/console
3. Sign in as:
   • Account ID: Your 12-digit AWS account number
   • Username: admin
   • Password: The password you set
4. You will be prompted to set a new password — do so
5. You will be prompted for MFA — scan the QR code with your authenticator app again (different from root’s MFA)
6. You should now be in the AWS Console as admin user
7. To verify: click the top-right menu — it should say admin @ account-id

Create the Developers Group

1. In the IAM Console, click User groups → Create group
2. Group name: Developers
3. Attach policies — search for and check:
   • AmazonS3ReadOnlyAccess (read S3 buckets and objects)
   • AmazonEC2ReadOnlyAccess (list and describe EC2 resources)
4. Click Create group

Create the Operators Group

1. Click Create group again
2. Group name: Operators
3. Attach policies:
   • AmazonEC2FullAccess (full control of EC2)
   • AmazonS3ReadOnlyAccess (read S3 — operators can view logs)
4. Click Create group

Create a Custom Policy

AWS managed policies are generic. You will often need custom policies tailored to your environment.

1. Click Policies → Create policy
2. Switch to the JSON tab
3. Paste this policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "S3ReadWriteSpecificBucket",
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject"
      ],
      "Resource": [
        "arn:aws:s3:::iam-lab-bucket-<your-initials>",
        "arn:aws:s3:::iam-lab-bucket-<your-initials>/*"
      ]
    },
    {
      "Sid": "DenyOutsideBusinessHours",
      "Effect": "Deny",
      "Action": "s3:*",
      "Resource": "*",
      "Condition": {
        "DateGreaterThanIfExists": {
          "aws:CurrentTime": "2026-12-31T18:00:00Z"
        }
      }
    }
  ]
}

4. Click Next
5. Policy name: Lab-S3-Bucket-Access
6. Description: Read/write access to lab bucket only
7. Click Create policy

Create Users and Assign to Groups

1. Go to Users → Create user

2. User name: alice

3. ☑ Provide user access to the AWS Management Console

4. ☑ I want to create an IAM user

5. Set a password (e.g., Alice!IAM2026)

6. Click Next

7. Permissions: ☑ Add user to group

8. Check the Developers group

9. Click Next → Create user

10. Repeat for bob:

    • Username: bob
    • Password: Bob!IAM2026
    • Group: Operators

11. Note: Download or record the sign-in URLs for both users.

Install the AWS CLI

# Linux (Ubuntu/Debian)
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install

# macOS
curl "https://awscli.amazonaws.com/AWSCLIV2.pkg" -o "AWSCLIV2.pkg"
sudo installer -pkg AWSCLIV2.pkg -target /

# Windows (PowerShell as Administrator)
msiexec.exe /i https://awscli.amazonaws.com/AWSCLIV2.msi

# Verify installation
aws --version
# Expected: aws-cli/2.x.x ...

Create an Access Key for CLI

1. In the IAM Console, go to Users → admin → Security credentials tab
2. Under Access keys, click Create access key
3. Use case: Command Line Interface (CLI)
4. ☑ I understand the above recommendation and want to proceed
5. Click Next → Create access key
6. IMPORTANT: Copy the Access Key ID and Secret Access Key
   • Store them in a password manager or download the CSV
   • You will not see the secret key again

Configure the CLI

# Configure the default profile
aws configure

# AWS Access Key ID [None]: <paste your access key ID>
# AWS Secret Access Key [None]: <paste your secret access key>
# Default region name [None]: us-east-1
# Default output format [None]: json

# Verify the configuration
aws sts get-caller-identity
# Expected:
# {
#     "UserId": "AIDAxxxxxxxxxxxx",
#     "Account": "123456789012",
#     "Arn": "arn:aws:iam::123456789012:user/admin"
# }

Create Named Profiles for Other Users

# Configure alice's profile
aws configure --profile alice
# Enter alice's access key and secret key
# Region: us-east-1
# Output: json

# Configure bob's profile
aws configure --profile bob
# Enter bob's access key and secret key
# Region: us-east-1
# Output: json

# Test each profile
aws sts get-caller-identity --profile alice
aws sts get-caller-identity --profile bob

Create an IAM User that Can Assume Roles

1. Go to Users → Create user
2. User name: role-test
3. Provide console access with a password
4. Attach the IAMFullAccess policy directly (so they can manage roles too)
5. Create the user

Add AssumeRole Permission to the User

The user needs permission to call sts:AssumeRole. Attach an inline policy:

1. Go to Users → role-test → Permissions → Add permissions → Create inline policy
2. Switch to JSON and paste:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "arn:aws:iam::*:role/EC2-S3-ReadOnly"
    }
  ]
}

3. Policy name: Assume-EC2-S3-Role
4. Click Create policy

Assume the Role

# Configure the role-test user's CLI profile (create access key first)
aws configure --profile role-test

# Try to list S3 buckets WITHOUT the role (should fail if role-test has no S3 perms)
aws s3 ls --profile role-test
# Expected: AccessDenied

# Assume the EC2-S3-ReadOnly role
ROLE_ARN="arn:aws:iam::$(aws sts get-caller-identity --query Account --output text):role/EC2-S3-ReadOnly"
ASSUMED_ROLE=$(aws sts assume-role \
  --role-arn $ROLE_ARN \
  --role-session-name "test-session" \
  --profile role-test)

# Extract temporary credentials
export AWS_ACCESS_KEY_ID=$(echo $ASSUMED_ROLE | jq -r '.Credentials.AccessKeyId')
export AWS_SECRET_ACCESS_KEY=$(echo $ASSUMED_ROLE | jq -r '.Credentials.SecretAccessKey')
export AWS_SESSION_TOKEN=$(echo $ASSUMED_ROLE | jq -r '.Credentials.SessionToken')

# Now list S3 buckets using the TEMPORARY role credentials
aws sts get-caller-identity
# Expected:
# {
#     "UserId": "AROAxxxxxxxxx:test-session",    <-- note: role, not user!
#     "Account": "123456789012",
#     "Arn": "arn:aws:sts::123456789012:assumed-role/EC2-S3-ReadOnly/test-session"
# }

aws s3 ls
# Expected: Lists buckets (S3 read-only via the role)

# The credentials expire (default: 1 hour)
# After expiry, you need to call assume-role again