‫Okay, so let's play with IAM policies.
‫So if we go into my user groups right now,
‫I can see that my group admin contains,
‫and this UI is a bit bugged,
‫contains one user, Stephane.
‫So if I go on the right hand side and go to my services
‫and I go to IAM, so I'll go to the IAM service.
‫I will show you one thing.
‫So, this user is an admin user.
‫And therefore, if you go to, for example, users,
‫you can see all the users.
‫Okay, great.
‫So, now what I'm going to do is I'm going
‫to remove Stephane from the admin groups.
‫I'm going to remove this user
‫and the user will lose the group permissions, that's true.
‫So the user has been removed from the group
‫and how do we make sure that this is applied?
‫Well, if I go on the right-hand side
‫and now refresh this page, as you can see,
‫I need permissions to access this page
‫and my user Stephane is not authorized
‫to perform IamListUsers on this page.
‫So that makes sense, right?
‫Because we removed the user Stephane from the admins group.
‫So, what I can do is I can fix this
‫and to fix it, I can go into my users.
‫Go to Stephane and now I can attach permissions
‫directly to my Stefane user.
‫So two ways of doing so, number one is to add permissions
‫and use policies that already exists or that you created
‫or add an inline policy to just add policies
‫directly to the user.
‫So, I'm going to add permissions
‫and I'm going to attach existing policies directly
‫and I will search for IAM.
‫And I'm going to look for IAM read-only access.
‫I review, I add these permissions
‫and now my user Stephane has IAM read only access.
‫What does that mean?
‫That means that, for example, if I refresh this page...
‫Then, as we can see, the user Stephane does exist.
‫But, for example, if I go to groups
‫and I try to create a group and call it "developers"
‫and create this group,
‫I'm going to get an exception
‫because I'm not authorized to do create group,
‫I was only authorized to have read-only access to IAM.
‫So this really shows the power of IAM and so on.
‫So, now if I go to my user groups, I can do two things.
‫So number one, I can go
‫into the admin group and I'm going to add back
‫this Stephane user so that we have administrator access.
‫The second thing I'm going to do is I'm going to
‫create a group named "developers".
‫And I'm also going to add Stephane into this group
‫and I'm going to attach a policy,
‫whatever the first policy I found
‫it was direct connect to read only access
‫and then create this group.
‫It doesn't matter which policy you're attached to,
‫I just want to show you a behavior.
‫Okay so, now we have two groups,
‫we have the admins and the developers,
‫and the user Stephane is in both groups.
‫So what's going to happen is
‫that if I click on the user Stephane
‫and look at the policies it has, it has three policies.
‫One that was attached directly named IAM ReadOnlyAccess.
‫One that was in two that were in Attached From Groups.
‫The first one is administrator access from the group admin.
‫And this one, it was direct connect read only access.
‫from the group's developers.
‫So, as we can see, the policies get inherited
‫in different ways through the IAM permissions.
‫So finally, I want to show you how policies work.
‫So if you go to policies,
‫we have a list of all the policies available
‫within AWS right here, their managed policy.
‫So this one is administrator access
‫and we've been using it before.
‫And if you look at the policy, JSON forum, as we can see
‫we have a version and we have a statement
‫that statement contains one statements
‫and the effect is allowed.
‫So to authorize action is "*",
‫that means any action resource is "*",
‫that means any resource.
‫So we allow all the actions on all the resources
‫therefore making this policy an administrator access policy.
‫We can go into policy summary as well
‫and this is another view of the policy.
‫We have allow on 284 services of 284.
‫Now services get added all the time,
‫so if you don't have the same number,
‫don't worry, the course is up to date.
‫So we can have a look at another policy.
‫For example, the IAM read only policy
‫that we've dealt with from before.
‫So, this time allows one service out of 284,
‫which is IAM.
‫And if we look at the JSON documents,
‫we can see all the actions that are authorized
‫by this IAM read only access.
‫So we get, for example, iam:get*,
‫the star GenerateCredentialsReport,
‫and so on, on the resource start.
‫There's also a way for you to create your own policy.
‫So you can go back to your policies and create a policy
‫and you have two ways of doing it.
‫Either, you want to write plain and simple JSON
‫or you can use the visual editor,
‫and this is quite handy.
‫For example, we can choose the service IAM,,
‫then we can choose an action.
‫And we can, for example, do a list user,
‫so I can filter for list users
‫for effects and I can do get user.
‫So, let's say we want to add these two actions
‫and on the resources we can specify specific resources
‫or all resources.
‫We could also specify a request condition if we wanted to.
‫So, once we've done that
‫if we go to the JSON documents
‫as we can see the visual editor SID was added,
‫which has the statement ID,
‫and we have two actions that were added.
‫So IAM list users and get users on resource start.
‫So it's quite a handy way to generate JSON directly
‫from the visual editor.
‫Okay. So, just to finish this lecture,
‫let's do a few things.
‫In user groups, I'm going to delete the developers group
‫cause I don't need it
‫and I need you to type the name of the group,
‫so I will type developers and click on deletes.
‫And also on my user as Stephane,
‫I'm going to remove the policy that was attached directly
‫because we don't need this IAM read only policy,
‫I will just remove it and we're good to go.
‫So, now my user Stephane has a full administrator access
‫because it is inherited from the admin group.
‫And so obviously if I go back to my IAM
‫also on the right side,
‫as we can see, everything is working just fine.
‫So I will refresh and here we go,
‫things are working.
‫So that's it for this lecture.
‫I hope you liked it
‫and I will see you in the next lecture.