AWS Security - IAM (Part-2) | Roles, Trust Relationship - Identity & Access Management

AWS IAM Identity & Access Management (Part 2) :
-What are IAM roles?
-What is the advantage of using IAM Roles?
-How to create and assume IAM Roles?
-Using IAM roles for users and AWS services
UPDATE: it is now possible to add/remove IAM role from an EC2 instance after the instance has been launched.
-----------------------------------------------------------
I would request to look at our playlists to learn systematically for AWS Certifications ---
Solutions Architect - • AWS - Associate Certif...
&&&
SysOps Administrator - • AWS SysOps Administrat...
++++++++++++++++++++++++++++++++++++++++
I have answered lot of AWS Interview questions in LIVE sessions here -- • AWS Interview Question...
Connect with me on LinkedIn to read interesting AWS updates & Practical Scenario Questions --- / knowledgeindia
Don't miss any updates, please follow my FB page AWStutorials
&
Twitter - #!/...
And for AWS exercises & case-studies, you can refer our blog -- aws-tutorials....
++++++++++++++++++++++++++++++++++++++++

[@punyabrotad]

Excellent tutorial...all the core concepts explained so clearly in less than 30 minutes (both parts combined).

[@knowledgeindia]

Thanks Punya. Please do check out our playlists for more such videos ... 👍👍👍

[@sreekanthreddylingamdinne363]

Now I have understood the idea and the uses of AWS IAM completely. Thanks for Making it available on youtube.

[@knowledgeindia]

Do check out our security playlist on KZbin channel

[@tannubajpai4782]

Thnx bro for ur service. I really admire ur all efforts.I wonder why u dont hv millions of views

[@knowledgeindia]

Please share it further and it will help everyone.. 🙂

[@rushikeshparab132]

Excellent explanation 😀

[@kalpanakalp5116]

Very well explained! Thanks for this!

[@onlyamitava]

Good explanation. Only one point - we can attach or detach IAM Role to an instance, after launching the instance.

[@knowledgeindia]

Yes, that's an update which came after the publishing of this video ✌️✌️

[@sunflower20505]

Thanks man, it helped me under stand the difference between Permissions and Trust Relationships

[@knowledgeindia]

Thanks a lot for your kind words. I request to spread the videos more and more so that people and friends could get benefited. Please Subscribe to our blog for exercises --- aws-tutorials.blogspot.in/p/page1.html (LIVE Session details are updated here) Like our FB page to know the announcements --- fb.me/AWStutorials - please write about us and tag our page on FB/LinkedIn. LinkedIn - in.linkedin.com/in/knowledgeindia Subscribe to our KZbin channel to get alerted about new videos --- kzbin.info Our Twitter handle is twitter.com/knowledge_india

[@mdabrar1017]

Now i think we can assign the role to EC2 even after launching it. In actions go to Instance settings and assign role

[@knowledgeindia]

Yes, it is possible now. But, this video was recorded before that :) Do check out other videos on our channel and share if you find them helpful..

[@adsingh1644]

​@@knowledgeindia I am still in doubt that how can I give an access of an EC2 instance/S3 to any IAM user. Could you please guide?

[@adsingh1644]

I am still in doubt that how can I give an access of an EC2 instance/S3 to any IAM user. Could you please guide?

[@adsingh1644]

I am still in doubt that how can I give an access of an EC2 instance/S3 to any IAM user. Could you please guide? waiting for your respons epls.

[@vijaykumarreddy5758]

nice explanation,thanks for knowledge sharing

[@knowledgeindia]

thanks Vijay. Please support us by sharing the videos.

[@salmanahmad1562]

Very nice explained ... Thanks a lot.

[@knowledgeindia]

Thanks Salman . Please check our other AWS videos on our channel..

[@mythoughts613]

Great video. Very helpful.

[@knowledgeindia]

Thanks a lot for appreciation. Please let your friends/colleagues know about our channel & AWS videos...

[@anubhavsrinivas9926]

it will be nice to see a video on IAM service roles, and how it connects to the other AWS services. Waiting for a video on that. please write back.

[@kadiransari9722]

Sir, Please upload the videos related to Directory Services, SSO & how to join the on-premise system in the domain....

[@ameyamagashe]

Yes please.

[@rsdeb2006]

excellent class

[@knowledgeindia]

Thanks a lot for appreciation. Please let your friends/colleagues know about our channel & AWS videos...

[@kotha891]

Good explanation thanks

[@knowledgeindia]

Thank you.. Please SUBSCRIBE to get alerted of new upcoming videos. If you have got benefited from this channel, please write about it at -- aws-tutorials.blogspot.in/p/do-you-like-it.html . You can also look at Live session details on the same page. SUBSCRIBE to the channel and blog. SHARE with your friends please or on your Social platforms. Follow our FB page -- fb.me/AWStutorials

[@clivesargeant394]

Great tutorial. Thanks!

[@agraws1]

You are awesome!. Your videos are very easy to understand. Were instance profile introduced later? If you can update the IAM video to include this as it is very confusing. thanks

[@vikramchaudhary5838]

Excellent tutorial Sir, I want to know that how to create role to use dynamoDB? What is the default policy size and how we increase policy size for roles of DynamoDB?

[@knowledgeindia]

there is only upper limit on policy size and that cannot be overridden. if you want to do DynamoDB related actions, then choose a permission which is related to DynamoDB, else write a custom one. To see more IAM videos, please subscribe to our channel.

[@vikramchaudhary5838]

Thank you For provides helpful Information. @@knowledgeindia

[@rammy7733]

Please upload a video for Cross Account/Roles access demo. Also for the Federated Users, and Okta. Thank you.

[@knowledgeindia]

Please check our security playlist

[@ibmuser13]

Good one!! Keep it up

[@knowledgeindia]

Thanks a lot. Please support us by sharing our video and channel with your friends..

[@funisthename]

Few things have changed now, We can attach/detach a ROLE even after creation of an EC2 instance. Please correct me if I am wrong. @KnowledgeIndia AWS Azure Tutorials

[@sujithsurendran7686]

Yes, the existing role would be replaced by the new role.

[@bijukumarbarik3259]

Thank you sir. sir i need one help for you. please upload migration process . physical server migration p2v or v2v aws web services or database. Please sir i request you....

[@adsingh1644]

I understood the process n concept of IAM. But i couldn't manage to give an access of any particular instance to any selected IAM user . Could you please guide me how can I make it possible using inline policy or if you can make a video on this.

[@ssaraswatipura]

Thank you KnowledgeIndia, Awesome videos. I noticed this specific video was created in 02/04/2019, that time Role was not able to attach or detach to an EC2-Instance once it is created, this has been changed and now Role can be attached or detached after creation of EC2-Instance, Please update this in your video.

[@knowledgeindia]

Thanks a lot for appreciation. Please let your friends/colleagues know about our channel & AWS videos... Unfortunately, youtube doesn't allow to update video. I shall update in description.

[@indranilgoswami1500]

Sir We can attach role in running instance also . like instance->Attach or replace IAM role . So the statement which you told that we can only add role while launching the ec2 instance is partially correct . Thanks

[@knowledgeindia]

Yes it has changed now. Earlier it was not so. Please see the date of video.. 😄😄

[@jas4u383]

Why ec2 doesn't need iam role to access Rds instance and other ec2 instance.? But need role to acess s3 and elastic cache..?

[@peaceofmine6785]

Can you please share information related to granting EKS access to an I AM user

[@kandukurimaneesha2869]

which type of permissions can we assign for each iam user

[@ambrishpatil4352]

How to create and attach role if the application is hosted on kubernetes and running in pods instead of EC2 instance ?

[@farhanziya8435]

I am little confused about the IAM role part. Do you mean that we do not have to speciy secret and access key in the application to connect to s3 when the role is applied directly on the ec2 machine? Can you please explain it a little bit more from application point of view, how is it going to be configured with the secret key and access key?

[@knowledgeindia]

you understood it right, you will not have to put keys in the application at all. Just give the IAM role to instance and the API calls originating from that instance would work.. Do check out other videos on our channel and share if you find them helpful..

[@jakessalli1411]

Thank you for videos, very informative! can we have a video how OPENVPN connect works and how to reset and create user with different MFA types. Thank you!

[@knowledgeindia]

Sure. I will try to do that in future.

[@jakessalli1411]

Thank you so much for response! so i connected to private instance through VPN ip and added user , also added Instance in domain.Please go ahead and let us know more on this and perticularly on VPN. How can we increase number of RDP's to an instance.Thanks in advance!! i really appricite your work.

[@knowledgeindia]

For a lot of RDP users, Appstream / Workspaces would be the right service. I will cover them soon. Please let me know your use case.

[@jakessalli1411]

Any video on these mainstream services from you will be much appreciated!

[@knowledgeindia]

Thanks Jakes. Please share the videos with your friends and colleagues, if you like its quality. I will put more videos soon.

[@MultiDevan13]

Hello, Knowledge India, great video! I have a question, In federated identities, if I have user pool and I have some identities inside that user pool. If I were to delete one of those identities, how can that identity add itself back? because it seems like once the identity is deleted, it cannot be added anymore.

[@srinivasan3078]

Good Show ! If I delete or remove the access keys of the root user can I re-get again or how can I recover it.

[@knowledgeindia]

Based on security requirements, AWS does not allow to download the key again. If you loose the key, just go to IAM console, delete the previous key (lost one) and create a new key. Make sure you use this key at all the places going forward. If you have got benefited from this channel, please write about it at -- aws-tutorials.blogspot.in/p/do-you-like-it.html You can also look at Live session details on the same page. SUBSCRIBE & SHARE with your friends please. Follow our FB page -- fb.me/AWStutorials

[@rkp_vv6143]

Can I add more than one roles to an EC2 instance?

[@knowledgeindia]

No, only one role can be added. But that role can have multiple permissions attached

[@arjunpratapsingh8613]

sir all parts are well explained but i didn't get the role concept meas how role is used and why it is neccessary?

[@knowledgeindia]

watch our Lambda video to understand that better.

[@sumanthvarma4059]

If i delete the IAM user which already running a few services running under that account, all those services gonna delete automatically?

[@jagdishbelapure7521]

Hi sir, I have understood and implemented what is taught in these two lectures on IAM and roles, and i am comfortable with the service, will these sessions be enough for appearing in CSAA certificate exam on IAM topic or do I need to prepare for any other stuff or material (for IAM), i am asking this question to understand level of toughness of the exam.

[@knowledgeindia]

Well, from IAM perspective, this should be mostly fine. You should also read the FAQ for IAM and KMS. I have to make a video on KMS as well.

[@08harishsingh]

Now with new update, we can change ROLE after or on running ec2

[@knowledgeindia]

right.

[@mayanktripathi4u]

Hi KI Team, In the IAM part 1... under Security Status, you mention to delete the root access keys, and then the check-box got turned to green. Just wanted to know why we need to delete the root access keys..? How does it impact? Are we not using the root access keys in any scenario...?

[@knowledgeindia]

ROOT user can not be restricted in any way. Hence, its better not to use ROOT keys and delete them. So that, nobody could get access to it, even by chance. If my videos are helpful, kindly share them with your friends. .. Please look at our playlists for more wonderful AWS videos.

[@kapilsharma4722]

for security issues, root a/c comes with unlimited authority . it might be miss use , so to avoid this its recommended to delete your root a/c

[@rangeshvenkatesan5856]

Sir ji ,, When you say .. "IAM TEST" - the user created WON'T BE able to log into the OS of EC2 or connect to RDS and run sql queries . Can you pls help me understand . Obv with that user, I can spin/launch any os and will be able to log in to that instance, which means logging into that OS [either through console or terminal [depending on the programmatic access] and i would be even able to add a EBS or launch a RDS too right ? pls clarify . thanks in advance .

[@knowledgeindia]

IAM users would be able to AWS level operations. E.g. Creating EC2, creating EBS, attaching EBS to an EC2, creating S3 bucket, deleting bucket. Anything at OS level or Database level (like running query etc.) would be done by a user created at OS or DB level. Please go ahead and create an EC2 or RDS and do the above things, it would be crystal clear.

[@knowledgeindia]

If you liked the channel, please write a testimonial/recommendation here --- aws-tutorials.blogspot.in/p/do-you-like-it.html

[@akashkharade2259]

I wanted to access "Dynamo db aws service" from web application deployed. Do I need to mention created "IAMUser" or role in my application? In properties file or something?

[@knowledgeindia]

Right method would be to create an IAM role and give this role to EC2 instance where your web application is hosted. Please share the videos with your friends.

[@akashkharade2259]

Thanks, sir. Can you create some videos on dynamo db service of aws also? It would be great.

[@venkysiddhu5135]

hi i'm not get clear difference between user & role . give the clear one

[@knowledgeindia]

try to do practical..

[@kidspooems]

can you please update content according to 2019

[@knowledgeindia]

Are you pointing any specific IAM topics?

[@shashankgupta4656]

How do I create a snapshot of an Amazon EBS RAID array?

[@knowledgeindia]

EBS snapshots are only per volume level

[@knowledgeindia]

Kindly ask the question on relevant video..

[@farooqmd]

can we select multiple roles to one instances

[@knowledgeindia]

Only one role but you can attach multiple policies to it

[@kapilsharma4722]

No . Only one role and that to when you create an instance

[@shibasisdas8631]

I have created 5 EC2 Machines , i want to give permission to only 3 EC2 Machines to some users of other AWS Account . How can i achieve this .

[@knowledgeindia]

Use Tag and Conditions based on Tags

[@shibasisdas8631]

Can you be a little bit more precise , how to handle this scenario.

[@thrinathkumar8749]

how to activate MFA?

[@knowledgeindia]

Steps are given in the documentation.. it's easy

[@thrinathkumar8749]

where is documentation??

[@thrinathkumar8749]

@@knowledgeindia bro im not getting wildryders website could you please help me

[@thrinathkumar8749]

@@knowledgeindia how to change bucket into wildryders website plzz make a video on that

[@hemanthkumar4325]

sir,please tell me how to upload a file to the s3 bucket using the browser im waiting for ur reply sir

[@knowledgeindia]

you can use AWS management console to upload the file or use a tool like S3Browser.

[@Rugit0]

You did not explain Trust Relationship please fix title very misleading

[@knowledgeindia]

kzbin.info/www/bejne/pGLVanmmbKx-rM0

[@jagdishbelapure7521]

Hello Sir, I have my exam scheduled on 21st July. The email from [e-mail] has below instruction. May i know what is special accommodation: the last statement of the email i received has below instruction, i haven't taken any special accommodation. Please guide Special Accommodations : Accommodations for your exam must be requested through your AWS Certification Account prior to scheduling your exam. If you have not made these arrangements prior to scheduling your exam, please cancel your scheduled exam and contact us for assistance in scheduling your accommodation exam. Cancellation policies are applicable to all exam schedules. To avoid cancellation fees, please be sure to cancel more than 48 hours prior to your scheduled exam. Regards, Jagdish

[@knowledgeindia]

Don't worry about it. That's for people if in case you are not knowing English etc. Just go and write normally.

[@jagdishbelapure7521]

Knowledge India thank you KI