AWS Security Operations
Internal
Setting AWS Credentials
Create a Key Pair
Amazon AWS instance access key pairs are explained here.
External reference for the procedures to create (or import) a key pair: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/get-set-up-for-amazon-ec2.html#create-a-key-pair
This procedure describes how to create the em provisioning key pair:
Go to the EC2 console https://us-west-2.console.aws.amazon.com/ec2/v2/home.
Left tab -> Network and Security -> Key Pairs -> Create Key Pair
The key is created and the file containing the private key is automatically downloaded by your browser. The base file name is the name you specified as the name of your key pair, and the file name extension is .pem. Save the private key file in a safe place.
Create a Security Group
Create a Security Group http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/get-set-up-for-amazon-ec2.html#create-a-base-security-group
List the Security Groups
EC2 Console -> Resources -> Security Groups.
IAM Operations
Create an IAM User
Creating an IAM user:
Create an IAM Group
Creating an IAM group:
Create an IAM Role
Creating an IAM role:
Create an ECS Task Role
This is the procedure to create an ECS task definition task role.
IAM Console: https://us-west-2.console.aws.amazon.com/iam/home#roles -> Create Role
Select type of trusted entity: "AWS service"
Choose the service that will use this role: "Elastic Container Service"
Select your use case: "Elastic Container Service Task: Allows ECS tasks to call AWS services on your behalf."
Next: Permissions
Select: AmazonECS_FullAccess ("Provides administrative access to Amazon ECS resources and enables ECS features through access to other AWS service resources, including VPCs, Auto Scaling groups, and CloudFormation stacks").
The role cannot be created with only AmazonECSServiceRolePolicy.
Set permissions boundary: Create role without permissions boundary
Next: Tags
Next: Review
Role name: playground-task-role
Description: A generic task role. Allows ECS tasks to call AWS services on the IAM user behalf.
Trusted entities: AWS service: ecs-tasks.amazonaws.com
Only roles that have "ecs-tasks.amazonaws.com" as Trusted entity are shown in the Task Role drop-down on Task Definition creation, so make sure that "Trusted entities" contains "AWS service: ecs-tasks.amazonaws.com"
Policies: AmazonECS_FullAccess
Permissions boundary: Permissions boundary is not set
Create Role.
Create an ECS Task Execution Role
This is the procedure to create an ECS task definition task execution role.
IAM Console: https://us-west-2.console.aws.amazon.com/iam/home#roles -> Create Role
Select type of trusted entity: "AWS service"
Choose the service that will use this role: "Elastic Container Service"
Select your use case: "Elastic Container Service Task: Allows ECS tasks to call AWS services on your behalf."
Next: Permissions
Select: AmazonECSTaskExecutionRolePolicy ("Provides access to other AWS service resources that are required to run Amazon ECS tasks")
Set permissions boundary: Create role without permissions boundary
Next: Tags
Next: Review
Role name: playground-task-execution-role
Description: A generic task execution role.
Trusted entities: AWS service: ecs-tasks.amazonaws.com
Only roles that have "ecs-tasks.amazonaws.com" as Trusted entity are shown in the Task execution role drop-down on Task Definition creation, so make sure that "Trusted entities" contains "AWS service: ecs-tasks.amazonaws.com"
Policies: AmazonECSTaskExecutionRolePolicy
Permissions boundary: Permissions boundary is not set
Create Role.
Create an API Gateway Role to Allow Pushing Logs to CloudWatch
IAM Console -> Roles -> Create Role -> Trusted Entity: AWS Service -> API Gateway -> Use case: API Gateway Allows API Gateway to push logs to CloudWatch Logs -> Next Permissions: "AmazonAPIGatewayPushToCloudWatchLogs" policy.
Managing IAM Policies
Create an IAM Policy
Creating an IAM Policy: