[Recipes] Using IAM Roles Instead of Configuring Credentials in AWS Command Line

1. Login to AWS console and go to IAM:

   1. Go to Roles (side menu)

   2. Create a role:  Give any name, select role type as Amazon EC2, Attach following policies: AmazonS3FullAccess.

2. Go to EC2:

   1. Launch a new instance: Select Amazon Linux AMI, t2 micro, select the role we created against IAM roles, tag as (Key: Name, Value:DemoEC2-WithRoles), use existing web dmz security group (or create one if needed), use existing EC2 key-pair(or create one if needed).

   2. Verify that role is attached from the dashboard.

   3. Wait until the EC2 instance is up and running.

3. Connect to the EC2 instance through ssh and elevate privileges: sudo su

4. Verify that there is no .aws folder:

   1. cd ~

   2. ls –a

5. Run again: aws s3 ls

   1. It should list your S3 buckets.

6. Try running: aws s3 help

   1. It should give a good description of this command with all available options.

7. Remove the EC2 instance.

8. Remove the user(s) created.

Exam Tips

1. You can only assign a role to an EC2 instance, only when you create that instance. However we can change the policy document for a role anytime.

2. Roles are universal; you can use them in any region.