3

I don't really see why I need the IAM user. Documentation says there are two ways to access EC2. One is to create access keys for your AWS account. The other is to use IAM. Amazon recommends IAM.

So I logged into the main account, and on the IAM page, I create an IAM user, and then created an IAM group, and then add the user to the IAM group with the AdministratorAccess policy. I also assigned a custom password under the 'Security Credentials' tab.

When I then select the user, it navigates to a summary page. On the summary page, there is a “User ARN:” definition, which includes the account id and username:

arn:aws:iam::account_id:user/username

With this information, I am able to sign out of the main AWS account and sign in as the IAM user, using the IAM user name and password I created for the user.

https://account_id.signin.aws.amazon.com/console/

Now the documentation says the Linux instances have no passwords. You have to specify the name of the key pair when you launch the instance and provide a private key when logging in using SSH. So as the IAM user, I create a key pair under "Network & Security". And I save the private key file in a safe place.

Finally, when I launch an instance, it prompts me for a key pair, so I select the key pair I created. Once the Instance is running, I try to connect from ssh:

$ ssh -i ~/.aws/username-key-pair-useast.pem [email protected]

And it doesn't work. I have to specify the user called ubuntu:

$ ssh -i ~/.aws/username-key-pair-useast.pem [email protected]

And then it works. But why doesn't allow me to connect to server with the IAM user? I thought the whole purpose of the IAM user was for extra security of my Instance. But if I am logging in with an ubuntu superuser and the IAM user is not added to the OS of the Instance, then what extra security does the IAM provide?

Furthermore, everything I done with the IAM user, I could have done with the main AWS account. For example, I can log into the main AWS account and create key pairs and launch an instance. So it seems that the IAM is just redundant.

I don't really see why I need the IAM user.

2

1 Answer 1

5

IAM users are for logging into AWS itself.

Ubuntu user (or similar) is for use in logging into EC2 instances created within AWS.

The IAM user offers additional security in that it may and should be created with reduced privileges. The root account, by contrast, is create for all new AWS accounts and is only meant to be used for rare admin tasks instead. The IAM account should be used for all day-to-day tasks. This becomes more important as you add additional users to your AWS account.

1
  • each sysadmin should have their own IAM user.
    – Skaperen
    Aug 30, 2016 at 5:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .