I don't really see why I need the IAM user. Documentation says there are two ways to access EC2. One is to create access keys for your AWS account. The other is to use IAM. Amazon recommends IAM.
So I logged into the main account, and on the IAM page, I create an IAM user, and then created an IAM group, and then add the user to the IAM group with the AdministratorAccess policy. I also assigned a custom password under the 'Security Credentials' tab.
When I then select the user, it navigates to a summary page. On the summary page, there is a “User ARN:” definition, which includes the account id and username:
With this information, I am able to sign out of the main AWS account and sign in as the IAM user, using the IAM user name and password I created for the user.
Now the documentation says the Linux instances have no passwords. You have to specify the name of the key pair when you launch the instance and provide a private key when logging in using SSH. So as the IAM user, I create a key pair under "Network & Security". And I save the private key file in a safe place.
Finally, when I launch an instance, it prompts me for a key pair, so I select the key pair I created. Once the Instance is running, I try to connect from ssh:
$ ssh -i ~/.aws/username-key-pair-useast.pem email@example.com
And it doesn't work. I have to specify the user called ubuntu:
$ ssh -i ~/.aws/username-key-pair-useast.pem firstname.lastname@example.org
And then it works. But why doesn't allow me to connect to server with the IAM user? I thought the whole purpose of the IAM user was for extra security of my Instance. But if I am logging in with an ubuntu superuser and the IAM user is not added to the OS of the Instance, then what extra security does the IAM provide?
Furthermore, everything I done with the IAM user, I could have done with the main AWS account. For example, I can log into the main AWS account and create key pairs and launch an instance. So it seems that the IAM is just redundant.
I don't really see why I need the IAM user.