- Now let's take a look at a demo for creating
a user and a group.
Okay, so we are in the AWS Management Console,
and we need to go to the identity
and access management service,
so there are a couple of ways we could go about that.
If we scroll down the list underneath all services,
then Identity and Access Management service would be
down here under Security, Identity, and Compliance,
so here it is, the first one.
We could click on that, or what I find to be easier is,
if you know the name of the service,
you could just type it in here under the search bar
and you can go right to it.
We can also find it under here.
You can see that I've been there recently,
so it's in my history.
Of course, I could also scroll down here
to Security, Identity, and Compliance,
or again, we could search there as well.
The other way that we could find a particular service
is that, if we don't know the name of the service,
then we could just type what it is,
the kind of functionality that we're looking for,
so Identity and Access Management would, of course,
be related to users and groups and access, right?
So we could type in users and scroll down, and there's IAM.
We could type in access,
and we could find IAM under there as well.
So, let's go ahead and go to the IAM service.
And so, here, we're going to create a user
and a couple of groups for that user to belong to.
First, you can see that we have a dashboard
for this particular service.
Most services will have a dashboard that kind of summarizes
what's going on in that service,
and then gives you ways of drilling down into the details.
Okay, so you can see here, our summary says that we have
one user and one group,
so if we take a look at our current users,
you'll see that, in this particular account,
I only have one user, I have mine,
so here's the richard user, and then my user account
belongs to the admin group.
And then, we can see a number of other details,
like how old the access key is
and how old the password is, those kinds of things,
so that's a good way of highlighting users
who need to rotate their access keys
or update their password,
and we can also see that I have an MFA device,
a virtual MFA device registered to that user,
and we'll talk about that later on, as well as access keys.
And so, you can also see up here in the top
that I am currently logged in as the richard user,
so let's go ahead and, before we create a user,
let's first create a couple of groups.
So you can see, we do have an admin group,
and the admin group has basically
the permissions to do everything.
It's like a super-admin or a super-user.
So, I'm gonna create a new group,
and let's call this one developers.
So, maybe I'm going to add a few users that will be
a part of a development team and they will need
certain level of access into AWS,
and I might create another group for DBAs,
another group for leads, and of course,
users could be members of multiple groups, right?
So a member of the developers group,
but could also be a member of the leads group
or power-user group and so on.
There's all kinds of ways
you could go about organizing that.
So, we'll go to next, and then, now,
it's asking us to attach a policy,
but we're going to come back to that,
and we'll talk about policies later on,
but for now, let's just go ahead and skip that
and we'll go ahead and create the group.
And so, we're going to do one more, create one more group.
We're going to call this one everyone,
and the reason I do this is because there are
certain types of permissions that I like to give everyone,
and instead of adding those permissions
to each individual user,
I can add those kinds of permissions,
those global, universal permissions, to one group
and then just put users into that group.
And then, if any one user needs to be
a little bit different,
I can always address that one user later on.
All right, so let's do the same thing.
We'll create this everyone group.
For now, we will skip the policy,
and we will come back to that.
All right, we're going to revisit that point
about policies here later on.
So, we'll go ahead and create the group,
and now you can see we have our developers group,
our everyone group, so now let's go ahead and create a user,
and this user will be, let's say, a developer,
so we can add a user.
Let's just call this user a.fowler for Amy Fowler,
and so they have a user name, and then,
down below, you'll see here what kind of access type.
How will they be accessing AWS?
Will they be accessing AWS resources programmatically,
or will they be using the console,
or will they be doing both?
And so, as a developer, they will probably be doing both,
but if I were to select programmatic access,
then you can see here, it enables an access key
and a secret key.
We're going to talk about those later on.
For now, I'm going to leave that off,
because ultimately, I don't want to have to find
some secure way of transferring that sensitive information
to the Amy Fowler user.
Email is not appropriate for that kind of thing.
You know, you might trust email,
you might trust things like Slack
and other messaging tools, but when it comes to
transferring credentials that could be used
in dangerous ways, I would prefer that these users
download these kinds of credentials directly from AWS,
rather than me downloading them
and then transferring them to them.
So, I am going to enable management console access,
and now I could do an auto-generated password,
but I do like to check that the user
must create a new password on next sign-in.
That way, they are forced to create a unique password
that only they know.
I can do the auto-generated password
and next go to permissions, and from here,
we could add them to a group, which we will do.
We could copy permissions from an existing user,
if you wanted to essentially duplicate another developer.
If I finish with the a.fowler user
and I want to add some other user,
then I could copy permissions from the a.fowler user,
or I could attach policies directly to the user.
And in some cases, that's appropriate,
but for now, we are simply going to add
the a.fowler user to the developers and the everyone groups.
Then, we can go ahead and tag.
The next one allows us to add tags to that user,
and so we could use tags to organize our environment.
So maybe this user, we could say name, Amy Fowler,
and we could, you know, what department do they work in?
And maybe she works in engineering and so on.
So again, tags are pretty well arbitrary key value pairs
that we can use to organize our environment,
so if we wanted to find certain resources
based on a tag, it makes it a whole lot easier.
And of course, when we get into other types of resources
like EC2 and S3 and other things,
we will talk about how tagging can also contribute
to automation and cost-attribution.
So, we'll go ahead and review,
and you can see here we are creating the a.fowler user
with an auto-generated password,
and they are parts of the developers and everyone group.
All right, so let's go ahead and create that user.
All right, so there we go.
We've created the a.fowler user,
and from here, we could download the user and the password
in a CSV file, or we could just show the password,
copy it, and then send that to them over Slack
or some other messaging system,
and then ensure that they go and immediately log in
and set their own unique password.
So, we will continue to explore these kinds of things
as the course goes on, so I'm gonna go ahead and copy that,
close that, and there you go.
We've created the a.fowler user
and the developers and everyone groups,
and like I said, we will continue to explore these things,
like access keys and policies, more as we move forward.