Chapter 1 used one identity, admin, for everything. Real accounts have many: one per person, one per program. IAM (Identity and Access Management) is where they live, and it costs nothing.

Users

aws iam create-user --user-name dana
aws iam list-users --query "Users[].UserName" --output text
aws iam get-user --user-name dana

A new user is an empty identity: no permissions, no password, no keys. Everything it can do is added on purpose. A login profile gives it a console password; an access key gives it the CLI.

aws iam create-access-key --user-name dana

The answer contains the key id (AKIA…) and the secret, shown exactly once. Each user may hold two keys so one can be rolled in while the other is retired. list-access-keys shows ids and status, never secrets.

Groups

aws iam create-group --group-name developers
aws iam add-user-to-group --group-name developers --user-name dana
aws iam get-group --group-name developers --query "Users[].UserName"
aws iam list-groups-for-user --user-name dana

A group is a set of users. Permissions attached to the group apply to every member, so the rule is: grant to groups, add people to groups. A user can be in several.

Acting as another user

Your CloudShell signs requests as admin. To try something as dana, put her key in a second profile:

aws configure set aws_access_key_id AKIA… --profile dana
aws configure set aws_secret_access_key … --profile dana
aws configure set region us-east-1 --profile dana
aws sts get-caller-identity --profile dana

--profile dana picks that section of ~/.aws/credentials for one command. The reply names user/dana; her first real command will fail with AccessDenied, because she has no permissions yet. The next lesson writes her some.