- So now let's take a look at an example
of how we would go about creating
and attaching policies.
So you can see I'm already logged into the console.
I'm on the identity and access management dashboard.
And from here, I'm gonna go over to policies.
You can see, as we've talked about policies,
can be, managed policies can be, first class objects.
And we can of course, filter by either
amazon manage policies or customer managed policies.
So I'm gonna go ahead and filter by customer managed,
and you can see that I've got a few policies
that I've created over the years
for doing personal things.
But I want to go ahead, for the sake of this demo,
create one.
So I'm gonna create a policy,
and from here, I have a number of options.
I can either copy one from an amazon policy
and then edit it to my liking.
I could use the policy generator,
or I could, using this last option,
I could just copy and paste and write it out in JSON.
I typically don't like to do that,
just because there's a lot of room for error
in a JSON document, it has to be valid.
So I generally like to use the generator,
that way I know that it's going
to create the appropriate syntax.
So for here I'm gonna select the policy generator.
And, for this policy, I want to allow,
and I'm going to say that I want my developers,
let's say we want to attach this to our developers,
I'm going to allow them EC2,
and I'm going to say that,
I have the option to say all actions but
here maybe I only want them to be
able to launch certain EC2 instances.
Create virtual machines.
You can see here there are a lot of things
that we could give them access to within EC2.
But I don't want them to have access to all of it,
I want them to have access to maybe tagging resources,
I want them to be able to create disk volumes,
as we'll talk about later.
I want them to be able to,
let me scroll all the way to the bottom here,
I want them to be able to launch virtual machines.
Which is this particular action, run instances.
I don't want them to be able to terminate instances though.
That's a dangerous operation,
I want to keep this particular group of people
from being able to do that.
So I'm gonna make sure that I leave that one unchecked.
So again, this is least privilege.
I'm giving them just enough to do their job.
And here, the ARN, because I'm choosing specific service
and actions, I can just say star.
In this particular case, I can just say you know what,
you can do these on, across everything,
across all resources, and of course,
because they are prefix with EC2,
they would only apply to EC2 resources anyway.
So now, when I click the next step,
you can see here that I have the policy that's been created,
I have a series, only one statement,
that says they're allowed to do these three actions
on any resource.
I'm gonna go ahead and name this something else,
I'm gonna call this EC2 access for developers.
And again that's arbitrary, that's up to you,
whatever you want to name it,
whatever makes sense for your particular business.
I'm gonna create the policy,
and of course, I can filter it,
if I want to go back and find it I can say,
filter my customer managed policies.
And here we go, here is that particular policy.
You can see, we could edit that if we wanted to.
We could see that it's not attached to anything.
So let's go back to the group that we created earlier.
Earlier, we created a group
and we gave that group EC2 full access.
An AWS managed policy,
but that particular policy grants far too many permissions,
I don't want our developers, ultimately,
to have that many permissions.
I want to again, grant least privilege.
So I'm going to detach that policy,
and I want to attach the policy that we just created.
So I'm going to filter by customer manage policy,
I'm going to find, here's my EC2 access for developers
that I want.
I'm going to click that, and attach.
And now, if I hit show policy,
you can see that my developers group is allowed
to create tags on EC2 resources, create volumes,
and launch EC2 instances.
And that's that, for creating and attaching policies.