IAM basics: users, groups, roles and policies

Run everything in PowerShell from C:\aws-lab. Policy files are written with Set-Content on purpose: Out-File in Windows PowerShell 5.1 saves UTF-16, which the CLI can’t read as JSON.

1Sign in as root and note the account number

Run this:

aws login --profile saat-root
$env:AWS_PROFILE = 'saat-root'
$acct = aws sts get-caller-identity --query Account --output text
$acct

You should see your 12-digit account number, for example:

123456789012

2Give the account a sign-in alias

Pick a name nobody else in the world has used, for example saatlab-yourname, and run:

aws iam create-account-alias --account-alias saatlab-yourname
aws iam list-account-aliases --query 'AccountAliases[0]' --output text

Your IAM users now sign in at https://saatlab-yourname.signin.aws.amazon.com/console.

3Create the group and attach two AWS managed policies

Paste this whole block:

aws iam create-group --group-name lab-readers
aws iam attach-group-policy --group-name lab-readers --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess
aws iam attach-group-policy --group-name lab-readers --policy-arn arn:aws:iam::aws:policy/SignInLocalDevelopmentAccess
aws iam list-attached-group-policies --group-name lab-readers --query 'AttachedPolicies[].PolicyName' --output text

The last command should print:

ReadOnlyAccess  SignInLocalDevelopmentAccess

4Create the user with a console password

Paste this whole block (it makes a random first password that must be changed at first sign-in):

aws iam create-user --user-name priya.dev --tags Key=course,Value=saatvedha-aws Key=lesson,Value=05 --query User.Arn --output text
aws iam add-user-to-group --user-name priya.dev --group-name lab-readers
$pw = 'Lab-' + [guid]::NewGuid().ToString('N').Substring(0,16) + '!a1'
aws iam create-login-profile --user-name priya.dev --password $pw --password-reset-required --query LoginProfile.UserName --output text
"First password: $pw"

You should see something like this:

arn:aws:iam::123456789012:user/priya.dev
priya.dev
First password: Lab-3f9c1a7e2b4d5c60!a1

5Create the role and its two policies

Paste this whole block:

@"
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "AWS": "arn:aws:iam::$($acct):user/priya.dev" },
    "Action": "sts:AssumeRole"
  }]
}
"@ | Set-Content trust.json

@"
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["ssm:PutParameter", "ssm:GetParameter", "ssm:DeleteParameter"],
    "Resource": "arn:aws:ssm:ap-south-1:$($acct):parameter/lab/*"
  }]
}
"@ | Set-Content ssm-writer.json

$roleArn = aws iam create-role --role-name lab-ssm-writer --assume-role-policy-document file://trust.json --tags Key=course,Value=saatvedha-aws Key=lesson,Value=05 --query Role.Arn --output text
aws iam put-role-policy --role-name lab-ssm-writer --policy-name write-lab-parameters --policy-document file://ssm-writer.json
$roleArn

You should see something like this:

arn:aws:iam::123456789012:role/lab-ssm-writer

6Sign in as Priya from the CLI

Run this, and sign in as priya.dev in the browser that opens. Use the alias sign-in page, then set a new password when asked:

Remove-Item Env:AWS_PROFILE
aws login --profile priya
aws sts get-caller-identity --profile priya --query Arn --output text

You should see something like this:

arn:aws:iam::123456789012:user/priya.dev

If the browser is already signed in as root, use a private window for Priya’s sign-in.

7Try to write as Priya, then through the role

Paste this whole block:

aws ssm put-parameter --profile priya --name /lab/05/test --type String --value hello

$c = aws sts assume-role --profile priya --role-arn $roleArn --role-session-name priya-test --query Credentials --output json | ConvertFrom-Json
$env:AWS_ACCESS_KEY_ID = $c.AccessKeyId; $env:AWS_SECRET_ACCESS_KEY = $c.SecretAccessKey; $env:AWS_SESSION_TOKEN = $c.SessionToken
aws sts get-caller-identity --query Arn --output text
aws ssm put-parameter --name /lab/05/test --type String --value hello

You should see something like this:

An error occurred (AccessDeniedException) when calling the PutParameter operation: User: arn:aws:iam::123456789012:user/priya.dev is not authorized to perform: ssm:PutParameter on resource: arn:aws:ssm:ap-south-1:123456789012:parameter/lab/05/test because no identity-based policy allows the ssm:PutParameter action
arn:aws:sts::123456789012:assumed-role/lab-ssm-writer/priya-test
{
    "Version": 1,
    "Tier": "Standard"
}

The first write failed with an implicit deny: nothing allowed it. The role session then succeeded, and its ARN shows both the role name and the session name. With no --profile and no AWS_PROFILE, the CLI used the three environment variables.

8Ask IAM before you try

Run this as root (the simulator lets you test permissions without making changes):

aws iam simulate-principal-policy --profile saat-root --policy-source-arn "arn:aws:iam::$($acct):user/priya.dev" --action-names ec2:DescribeInstances ec2:TerminateInstances --query 'EvaluationResults[].[EvalActionName,EvalDecision]' --output text

You should see this:

ec2:DescribeInstances   allowed
ec2:TerminateInstances  implicitDeny

✅ Checkpoint: Priya was denied with “no identity-based policy allows”, the role session wrote /lab/05/test, and the simulator shows implicitDeny for terminating instances. Keep everything for the break lab; cleanup is at the end of it.