# AWS Zero to Hero day 3

## What is S3 Bucket in AWS?

* Amazon Simple Storage Service (Amazon S3) is a scalable object storage service provided by Amazon Web Services (AWS). It is designed to store and retrieve any amount of data from anywhere on the web.
    
* S3 is commonly used for a variety of purposes, such as backup and restore, archiving, content distribution, and hosting static websites.
    
* S3 Documentation: [Click me](https://docs.aws.amazon.com/s3/?icmpid=docs_homepage_featuredsvcs)
    

## What is IAM in AWS?

* IAM stands for Identity and Access Management. IAM is a web service that helps you securely control access to AWS resources. It enables you to manage users, groups, and permissions to securely access and use AWS services and resources.
    

#### key components of IAM:

* Users
    
* Groups
    
* Roles
    
* Policies
    
* IAM Documentation: [Click me](https://aws.amazon.com/iam/?gclid=Cj0KCQiA67CrBhC1ARIsACKAa8QO24yZlrPkHNhtrrjI1zqNu85WCpVUCJgiNaYEouhOX5HIRu1QUTsaAroQEALw_wcB&trk=858d3377-dc99-4b71-b7d9-dfbd53b3fb6c&sc_channel=ps&ef_id=Cj0KCQiA67CrBhC1ARIsACKAa8QO24yZlrPkHNhtrrjI1zqNu85WCpVUCJgiNaYEouhOX5HIRu1QUTsaAroQEALw_wcB:G:s&s_kwcid=AL!4422!3!651612429263!p!!g!!amazon%20iam!19836375022!146902912293)
    

## What is AWSCLI?

* The AWS Command Line Interface (AWS CLI) is a set of open-source command-line tools for interacting with Amazon Web Services (AWS) services. It allows users to control and manage AWS services directly from the command line, rather than using the AWS Management Console.
    
* AWSCLI Documentation: [Click me](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-welcome.html)
    

## Tasks:

1. #### Make a private S3 bucket in AWS and change the policy so you can access its stuff without making it public.  
    

> `Note:` Task1 will help you to understand how we can secure our S3 buckets.

**ans:**

* Bucket created with blocked public access
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744786655091/77b502dd-4b38-4e65-b814-2d5e7faf22f2.png align="center")
    
* Attached this bucket policy to access, create, and modify the created S3 bucket to particular IAM user
    
    ```bash
    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Sid": "AllowUserAccessToBucket",
                "Effect": "Allow",
                "Principal": {
                    "AWS": "arn:aws:iam::851725581476:user/aws-zero-to-hero-course-user"
                },
                "Action": [
                    "s3:GetObject",
                    "s3:PutObject",
                    "s3:ListBucket"
                ],
                "Resource": [
                    "arn:aws:s3:::aws-zero-to-hero-day-3",
                    "arn:aws:s3:::aws-zero-to-hero-day-3/*"
                ]
            }
        ]
    }
    ```
    
* ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744786722104/26b09988-1c13-42d8-ba4d-7043d174eb6e.png align="center")
    
    Then, I clicked on Save changes
    
* After that, I launched the instance to test the working of this
    
* You can see that i can not access all buckets, i can only access the specified bucket in my bucket policies, even though my IAM user does not have S3 permission
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744788144620/e968cc32-9ad0-46f1-978d-d69d22e2643f.png align="center")
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744788168022/9642444b-a37d-45f8-8445-18dac4fac246.png align="center")
    
* You can see that I can upload a file in my bucket without making it public by providing access to particular user in bucket policy
    
* ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744788237768/1934a308-77d0-4d3a-a9b8-958ff8971942.png align="center")
    
    Content of `test.txt`:
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744788283615/08b84137-28a4-402b-8972-5a16fdaf7d6e.png align="center")
    

2. #### Configure AWSCLI on your Ubuntu machine.
    
    **ans :**
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744788621624/c16eafe6-798e-48c0-b243-1816ec2fef37.png align="center")
    
3. #### Create an EC2 instance using AWSCLI.
    
    ####   
    `Note:` Task3 will help you to understand AWSCLI more clearly.  
    `Hint:`Resource to complete task3: [EC2 using AWSCLI](https://madhup.hashnode.dev/creating-an-ec2-instance-on-aws-using-awscli)
    
    **ans:**
    

* So, I have created the instance using the above guide
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744790121796/df729785-387e-4e65-9966-675a08557e96.png align="center")
    
* Which I can SSH too to it.
    
* ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744790221705/1887903b-0d07-40b8-b691-616e62831ba8.png align="center")
    
    To run an instance with Tag Name, I ran this command: `aws ec2 run-instances --image-id=ami-0fc5d935ebf8bc3bc --instance-type=t2.micro --region=us-east-1 --key-name=MyKeyPair --security-groups=my-sg --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=test-instance}]'`
    
* <mark>Note: An Instance will not be SSH if the private key is not properly formatted.</mark>
    

4. #### Setting Up AWS IAM for a New Team Member
    

`Scenario:` Imagine you're working as an IT administrator at GlobalTech Inc., a multinational company with diverse cloud computing needs. The company heavily relies on AWS services for its operations. You have a new colleague, Alex, who recently joined your team. Alex's role involves monitoring the company's computing resources and managing data storage. Your task is to set up Alex's AWS access.  

What needs to be done:

* Configure AWS IAM (Identity and Access Management) to provide Alex with specific access rights. Alex should be able to:
    
    * View EC2 Instances: Alex needs to monitor the virtual servers running in the AWS cloud but should not be able to modify them.
        
    * Create S3 Buckets: Alex is responsible for creating new storage spaces for various projects.
        

**ans:**

* So, I have created the User Alex with `EC2ReadOnlyAccess` and `AmazonS3FullAccess` for the above scenario
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744790581716/a9ef21a1-f28c-4d91-9f7e-bc4cf7923a98.png align="center")
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744790606413/ef71e9ba-ee56-443f-8d22-66f7a7ec8a25.png align="center")
    
* After that I logged in as Alex
    
* And i tried to delete the EC2 service but i can not delete it because Alex has only Read permission
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744791040213/ce532d33-14d6-4f87-a3e5-62c02eb9c11c.png align="center")
    
* At the other place, with the permission of S3 full access, I can create bucket and upload object in that
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744791187660/bd699e73-01ae-45e1-aedf-313400611044.png align="center")
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744791192837/beb73215-bbd4-4f54-8a9d-1e43f45e9310.png align="center")
    

Completed Day 3 of AWS Zero to Hero Challenge