AWS IAM (Identity and Access Management) lab:

As part of my AWS Cloud Architecture training, I recently completed a hands-on lab on AWS IAM (Identity and Access Management). In this blog, I’ll share the steps I followed during the lab and the key things I learned along the way.

What is AWS IAM?

AWS Identity and Access Management (IAM) is a service that helps control access to AWS resources. Using IAM, we can create users, organize them into groups, and assign permissions based on their roles.

Some important IAM concepts I learned are:

• Users — Individual people or applications that need access to AWS resources.
• Groups — A collection of users with similar permissions.
• Policies— Documents that define what actions are allowed or denied.
• Managed Policies— Predefined policies provided by AWS.
• Inline Policies— Custom policies created for specific requirements.

Business Scenario

In this lab, the company was using Amazon EC2 and Amazon S3 extensively. The goal was to provide access to new employees based on their responsibilities.

Lab Steps

Task 1: Exploring Users and Groups

1. Open the AWS Management Console and note your current Region (example: N. Virginia).

2. Go to Services → Search for and select IAM.

3. In the left navigation pane, click Users.

• You will see three pre-created users: user-1, user-2 and user-3.

4. Click on user-1 and check:

• Permissions tab: No permissions assigned
• Groups tab: Not a member of any group
• Security credentials: Has a console password

5. In the left menu, click User groups.

• You will see three groups: EC2-Admin, EC2-Support, and S3-Support.

6. Explore the groups:

• EC2-Support group has the AmazonEC2ReadOnlyAccess managed policy.
• S3-Support group has the AmazonS3ReadOnlyAccess managed policy.
• EC2-Admin group has an inline policy that allows starting and stopping instances.

Task 2: Adding Users to Groups

1. Add user-1 to S3-Support group

• Go to User groups → Click S3-Support.
• Go to the Users tab → Click Add users.
• Select user-1 → Click Add users.

2. Add user-2 to EC2-Support group

• Follow the same process to add user-2 to the EC2-Support group.

3. Add user-3 to EC2-Admin group

• Add user-3 to the EC2-Admin group using the same steps.

4. Verification: Each group should now show 1 user.

Task 3: Testing User Permissions

Step1 : Get the Sign-in URL

• Go to the IAM Dashboard and copy the Sign-in URL for IAM users at the top of the page.

step 2 : Test user-1 (S3 Support)

1. Open a private/incognito browser window.

2. Paste the sign-in URL and log in as:

• IAM user name: user-1
• Password: Lab-Password1

3. Go to S3 → You can view buckets and objects.

4. Go to EC2 → Access denied.

Step 3 : Test user-2 (EC2 Support)

1. Sign out and sign in as user-2 and Password: Lab-Password2.

2. Go to EC2→ You can view instances but cannot stop or start them.

3. Go to S3 → Access denied.

Step 4 : Test user-3 (EC2 Admin)

1. Sign out and sign in as user-3 and Password: Lab-Password3.

2. Go to EC2 → You can view instances.

3. Select an instance → Choose Stop instance.

The action should succeed because user-3 has the required permissions.

Key Learnings from This Lab

• IAM follows the principle of least privilege , only give the minimum permissions needed.
• Using groups makes permission management much easier and scalable.
• Managed policies are maintained by AWS and update automatically.
• Always test permissions with real user sign-ins.
• Inline policies are useful for very specific, one-off requirements.

Conclusion

This IAM hands-on lab gave me a solid understanding of how access control and security work in AWS. Proper IAM setup is essential for keeping cloud environments secure and organized.