- [Instructor] Alright, so now let's take a look
at a demo of creating a user and group
within AWS Identity And Access Management.
You can see that I'm already logged in
to the AWS console and from here, I'm going to go
to the Identity And Access Management service.
Here's the dashboard of Identity And Access Management
you can see, at a glance
that I already have a couple of users.
I have one group already, an Admin group.
I have some roles.
You can also see that the IM service
gives us a checklist of things
that we need to do to ensure
that we have the greatest security within our environment.
So, from here, I'm going to ...
First thing I want to do is create a user for Jane Doe.
So, I'm gonna go ahead and go to my Users.
I'm going to create a new user and here I'm going to
say Jane.Doe.
We're going to talk about access keys later,
but for now I'm going to uncheck that.
And Create.
And you can see, now I have the Jane Doe user.
Now, at this point, you can see here
that my user has a password but Jane does not.
So, at this point, Jane can't do anything.
She doesn't have access to the console.
She doesn't have access keys for the CLI,
again, we'll talk about access keys here later on,
but Jane has no permissions either, she just has an account
that she can't access and can't do anything with.
In order for Jane to be able to actually do something
she needs to at least be able to log into the console.
And in order to log in, you need a password.
So, I'm going to click through to the details of Jane's user
make sure that I'm on the Security Credentials tab.
I'm gonna come down here to manage password
and from here, I'm going to just assign
an auto generated password and I want to ensure
that Jane is required to change that next time she logs in.
So, once I hit Apply,
this is the only time that I will be
able to see that password that was generated.
So from here, I would copy and paste this and give it
to Jane in some kind of secure way
over an encrypted connection of some kind
and that's the only time I would
ever share credentials: is when I know that this user
is going to be prompted to change their password
when they log in.
So, I'm gonna go ahead an close that.
And you can see here that Jane does have a password.
So, now she has access to the console,
but she still doesn't have any permissions.
I'm going to grant her permissions by way of using a group.
And so, I'm gonna come over here
to the groups.
You can see I already have an Admin group
that my user is a part of,
but I want to create a group for developers.
So, I'm going to create a group.
This is totally arbitrary, what you name it.
There's nothing Amazon Web Services that says you have to
name it in any particular way.
I'm gonna call this one Developers
because that's what Jane is, in this example.
And from here, now the wizard is prompting us
to attach policies, and we're going to talk about
policies later, but for now, sufficed to say
that policies are a way of granting
our user permissions to do things.
And so, I want our developers to be able to launch
EC2 instances, or virtual machines, so I'm going to
give them
EC2
full access.
And I'm going to go ahead and create that group
and now you can see that we have a Developers group
but we don't have any users in it yet.
So I'm gonna click through.
I'm going to Add Users To the Group.
Select Jane.
Click Add Users and now you can see that Jane
is a member of the Developers group.
We can see that the Developers group has access to
Amazon EC2.