Step 2 - Use temporary credentials

In this exercise we will use AWS IAM Roles to avoid the usage of AWS IAM access keys that may be required by the Amazon ELastic Compute Cloud (EC2) instance to access AWS resources. We will create a Role and assigned it to EC2 instance, instead of hard coding the access keys within the EC2 instance.

Note: For this lab, it is assumed that EC2 instance is already created with default settings. For instructions to create EC2 Instance please follow the link.

  1. From the AWS console, on the top right corner, click on the drop-down list where your IAM user and Account is mentioned.

iamr_01.png

  1. From the drop-down list, click on My Security Credentials.

  2. Scroll down the page and under the ‘Access keys for CLI, SDK, & API access’ section and note the staus of any active Access key ID. Anyone with access to these long-lived keys can use them to perform actions with the configured permissions. Instead of Access Keys, we will create a role because they provide short term access.

iamr_02.png

  1. To avoid the access key usage we first need to create an IAM role. Click on Roles on the menu on the left side of the console under Access Management.

  2. Click on Create role.

iamr_03.png

  1. Click on AWS service. Then click on EC2 under ‘Choose a use case’ section.

iamr_04.png

  1. Click Next: Permission.

  2. In the Search field type the policy that you want to attach to your EC2 instance and select from the list below i.e., AmazonRekognitionReadOnlyAccess policy.

iamr_05.png

  1. Click Next: Tags.

  2. Provide the optional Key and value to the tag.

  3. Click Next: Review

  4. Provide a meaningful name for the Role and optional description. Click Create role.

iamr_06.png

  1. You will notice the newly created role is now appearing in the list of roles.

  2. Go to services, click EC2.

  3. On the dashboard, click on Instances (running). We will create a Role and assign it to the EC2 instance, instead of hard coding the access keys within the EC2 instance.

  4. Select your EC2 instance that you want to assigned the role. Click Actions -> Security -> Modify IAM role.

iamr_07.png

  1. From the drop-down list of IAM roles, select the role that you have created in the previous steps.

  2. Click Save. Your EC2 instance can now access the required AWS service with minimum privilege.

  3. We will now disable the Access Key as it is no longer required.

  4. From the AWS console, on the top right corner, click on the drop-down list where your IAM user and Account is mentioned and click on My Security Credentials.

  5. Scroll down the page and under the ‘Access keys for CLI, SDK, & API access’ section click on Make Inactive under the Actions column of the mentioned Access Key.

  6. Click on Deactivate on the confirmation dialogue box.

  7. You will notice the message about deactivation of your IAM user Access key.

iamr_08.png

For more information please read the AWS User Guide: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html