Lesson 03 — IAM Users

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 02 – Identity & Access Management (IAM)

---

🎯 Lesson Objective

By the end of this lesson, you will be able to:

• Understand what an IAM User is.
• Create IAM Users using the AWS Console and AWS CLI.
• Configure console and programmatic access.
• Manage passwords and access keys.
• Understand the IAM user lifecycle.
• Apply enterprise security best practices for IAM Users.

---

📚 Lesson Information

Estimated Time: 3 Hours

Difficulty: Beginner

Prerequisites: Lesson 02

Hands-on Lab: Yes

Assignment: Yes

---

💼 Business Value

Every employee who requires direct access to AWS needs an identity.

Without proper user management:

• Shared accounts appear.
• Access becomes difficult to audit.
• Former employees retain access.
• Credentials become compromised.
• Compliance requirements fail.

A Cloud Security Engineer must ensure that every user has:

• A unique identity.
• Appropriate permissions.
• Multi-Factor Authentication.
• Secure credentials.
• Proper lifecycle management.

---

🏢 In the Company

CloudNova Technologies has hired several new employees.

The HR department has sent the following onboarding request.

Employee	Department
Rohit	Cloud Engineering
Alice	Development
John	Security
Sarah	Finance
David	SOC

Before they can begin work, AWS identities must be created.

This responsibility belongs to the Cloud Security Team.

---

🌍 What is an IAM User?

An IAM User represents an individual person or application that requires long-term access to AWS.

Each IAM User has:

• Username
• Password (optional)
• Access Keys (optional)
• MFA Device (recommended)
• Permissions

Each user should represent one individual only.

---

❌ Shared Accounts

Never create shared AWS accounts.

Bad Example

Developer

Password:
developer123

Everyone uses the same account.

Problems:

• No accountability
• No audit trail
• Impossible to identify actions
• Compliance violations

---

✅ Individual Users

Correct Example

rohit.cloud

alice.dev

john.security

sarah.finance

Every action can now be audited.

---

🏗 IAM User Lifecycle

Every IAM User follows a lifecycle.

Request Access

↓

Create User

↓

Assign Permissions

↓

Enable MFA

↓

Monitor Activity

↓

Modify Permissions

↓

Disable User

↓

Delete User

This process should be documented and repeatable.

---

🔐 Types of User Access

Console Access

Allows users to log in to the AWS Management Console.

Requirements:

• Username
• Password
• MFA (recommended)

---

Programmatic Access

Used by:

• AWS CLI
• SDKs
• Automation Scripts

Requires:

• Access Key ID
• Secret Access Key

Best Practice:

Avoid long-term access keys where possible. Prefer IAM Roles and temporary credentials.

---

🛡 Security Best Practices

Always:

• Create one user per person.
• Enable MFA.
• Follow Least Privilege.
• Rotate credentials.
• Remove inactive users.
• Monitor login activity.
• Avoid using Root User.
• Avoid long-lived access keys.

---

👥 CloudNova IAM Users

For this course, create the following enterprise users.

User	Department
cloud-admin	Cloud Team
rohit.cloud	Cloud Engineer
alice.dev	Developer
john.security	Security
sarah.finance	Finance
david.soc	SOC

These users will be used throughout the remaining IAM lessons.

---

🧪 Enterprise Mission 01 — View Existing Users

Open AWS Console.

Navigate to:

IAM

↓

Users

Review:

• User Names
• Console Access
• Last Activity
• MFA Status

---

🧪 Enterprise Mission 02 — Create IAM User (Console)

Navigate to:

IAM

↓

Users

↓

Create User

Create the following user:

alice.dev

Enable:

AWS Management Console Access

Choose:

Autogenerated Password

Require:

User must create a new password at next sign-in

Do not assign AdministratorAccess to developers.

---

🧪 Enterprise Mission 03 — Create IAM User (AWS CLI)

Open PowerShell.

Create a user.

aws iam create-user --user-name rohit.cloud

Expected Output:

{
  "User": {
    "UserName": "rohit.cloud",
    "Arn": "arn:aws:iam::123456789012:user/rohit.cloud"
  }
}

Verify:

aws iam list-users

---

🧪 Enterprise Mission 04 — Create Multiple Users

Run:

aws iam create-user --user-name john.security

aws iam create-user --user-name sarah.finance

aws iam create-user --user-name david.soc

Verify:

aws iam list-users

---

🧪 Enterprise Mission 05 — View User Details

Retrieve information about a user.

aws iam get-user --user-name alice.dev

Review:

• ARN
• User ID
• Creation Date
• Path

---

🧪 Enterprise Mission 06 — Create Login Profile

Create a console password.

aws iam create-login-profile \
--user-name alice.dev \
--password TempPassword@123 \
--password-reset-required

Verify:

aws iam get-login-profile \
--user-name alice.dev

---

🧪 Enterprise Mission 07 — Create Access Keys

Create Access Keys.

aws iam create-access-key \
--user-name alice.dev

Observe:

• Access Key ID
• Secret Access Key

⚠️ Important

The Secret Access Key is displayed only once.

Store it securely.

---

🧪 Enterprise Mission 08 — List Access Keys

aws iam list-access-keys \
--user-name alice.dev

Questions:

• How many keys exist?
• Are unused keys present?
• Should keys be rotated?

---

🧪 Enterprise Mission 09 — Delete Access Keys

First list keys.

aws iam list-access-keys \
--user-name alice.dev

Delete the key.

aws iam delete-access-key \
--user-name alice.dev \
--access-key-id ACCESS_KEY_ID

Replace:

ACCESS_KEY_ID

with the Access Key ID from the previous command.

---

🧪 Enterprise Mission 10 — Disable a User

Deactivate console access.

aws iam delete-login-profile \
--user-name alice.dev

Verify.

aws iam get-login-profile \
--user-name alice.dev

Expected:

NoSuchEntity

---

🧪 Enterprise Mission 11 — Delete User

Delete the user.

aws iam delete-user \
--user-name alice.dev

Verify.

aws iam list-users

---

🏢 Enterprise Scenario

CloudNova recently completed an audit.

The auditor identified the following issues.

• Shared AWS accounts
• Users without MFA
• Developers using AdministratorAccess
• Old access keys
• Former employees still active
• No user review process

You have been asked to redesign the IAM User management process.

Recommend:

• User naming standards
• Password policy
• MFA requirements
• Access review frequency
• User offboarding process

---

🧪 Enterprise Challenge

CloudNova is hiring:

• 25 Developers
• 10 Cloud Engineers
• 6 Security Engineers
• 5 Finance Staff
• 4 SOC Analysts

Design a naming convention.

Example:

firstname.department

rohit.cloud

alice.dev

john.security

Would you:

• Create users manually?
• Use automation?
• Integrate with AWS IAM Identity Center?

Explain your decision.

---

📊 Knowledge Check

1. What is an IAM User?

2. Why should every employee have a unique account?

3. What is the difference between console access and programmatic access?

4. Why should long-term access keys be avoided?

5. Which command creates an IAM User?

6. Which command lists all IAM Users?

7. Which command creates Access Keys?

8. Why should MFA be enabled?

9. What happens when a login profile is deleted?

10. What is the first step when an employee leaves the organisation?

---

📝 Assignment

Create a document titled:

Enterprise IAM User Management Guide

Include:

• IAM User overview
• Console vs Programmatic Access
• User Lifecycle
• User Naming Standards
• Security Best Practices
• AWS CLI Commands Used
• Screenshots
• Lessons Learned

Length:

4–5 Pages

---

📋 Lesson Completion Checklist

Task	Status
Reviewed Existing Users	☐
Created IAM User (Console)	☐
Created IAM User (CLI)	☐
Viewed User Details	☐
Created Login Profile	☐
Created Access Keys	☐
Listed Access Keys	☐
Deleted Access Keys	☐
Deleted Login Profile	☐
Deleted Test User	☐
Completed Assignment	☐

---

💡 Key Takeaways

After completing this lesson, you should understand:

• IAM Users provide long-term identities for individuals.
• Every employee should have a unique IAM User.
• Console access and programmatic access serve different purposes.
• Access keys should be carefully managed and replaced with IAM Roles whenever possible.
• IAM User lifecycle management is essential for enterprise security.
• Consistent naming conventions and onboarding/offboarding processes improve governance and auditability.

---

📚 Further Reading

• AWS IAM User Guide
• AWS IAM Best Practices
• AWS CLI Command Reference – IAM
• AWS Security Best Practices
• AWS Well-Architected Framework – Security Pillar

---

🚀 Next Lesson

➡️ Lesson 04 — IAM Groups