Create Adding and Managing IAM Permissions to Users to Wiki

[JasonEb]

Overview

As an Ops member, I'd like to have documentation that shows how to apply permissions and manage user groups within AWS IAM so I can have an online reference.

Documentation should feature screenshots like seen in the Ops Wiki.

Action Items

• Clarify process between Adding Permissions and Adding to User Groups
• Update wiki
  • Should go under AWS User Management
  • Should have it's heading like "Adding Permissions"
  • Should cover and provide an explanation of what an AWS Managed Policy vs Inline
  • Should have a remark about when to
    • add a user to a user group
    • when to add permissions directly to a usergroup or create a new user group for a certain permissions

Resources/Instructions

https://github.com/hackforla/ops/wiki/AWS-User-Management

https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction_access-management.html

[Tyson-miller]

It'd be great if this can be done alongside (or after) this issue to investigate automating IAM users with terraform.

[ExperimentsInHonesty]

This issue seems to have been worked on but not finished. It details a process that we are no longer doing, since we are now adding users via terraform. Should the page https://github.com/hackforla/ops/wiki/AWS-User-Management be removed from the wiki and do you think this page replaces that https://github.com/hackforla/ops/wiki/Permission-levels-for-Team-Members.

[chelseybeck]

Everything in this issue has been resolved. The https://github.com/hackforla/ops/wiki/AWS-User-Management has been deleted.

Previous page contents

For reference on IAM users, go down to "Creating IAM Users" to follow a step by step instructions on how to create a user from Amazons documentation.

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html#id_users_create_console

(Note: To add a user, either the team lead or the correct administrative user will need to grant you access to HackForLA's AWS incubator platform).

To add a user via IAM

1. Please go to: https://hfla-incubator.signin.aws.amazon.com/console and sign in to the console homepage.

2. Once you have arrived, please either type in IAM in the search bar at the top left or click on the IAM under "Recently visited" per below.

3. Once you have arrived at the IAM home screen, click on "User" under Access Management"

4. Click on "Add Users" at the top right of the screen

5. Enter in the name of The User and be sure to and click on the checkbox "Provide user access to the AWS Management Console" in order to create a password for the user to use. Autogenerate the password and allow the check box for users to create a new password when signing in.
   (NOTE: The name of the user should be in the format of "lastname"."firstname")

6. From here, click on the perferred permission settings for the user and click next.

(Note: When adding a new user, it is best practice to add the users to user group of ops-group since read only access is applied to this group)

7. Review the new user and click "Create user"

8. The User will be created. From here, you will have to send the password to the user by clicking the "show" button.

(Note: The "Email sign-in instructions" is utulized using Outlook or any type of email service you have on your local machine and it is recommended to send the password via Slack)

9. Once everyhthing is complete, click on "return to users list" and click on the user that you have just created.

10. On the user summary page, click on "tags".

11. Click on "manage tag" and click on "Add new tag" to add in the users email address and click on save changes.

(Note: You will need to get the users email address from Google Share Drive as well as their Slack ID and what project the user is currently on.)

Security Recommendations:

1. Do not use root account for creating a user. The root user credentials should not be used for daily tasks.
2. Grant the ReadOnlyAccess policy to every newly created user. Set a baseline privilege as the ReadOnly Access during onboarding process. Add additional permissions regarding user’s role in the company after discussing user’s responsibilities within the company.
3. Do Not allow user to self-manage tags. Do Not allow user to add a tag while managing tags.
4. Use autogenerated password when creating a new user.
5. Require MFA for additional security (Authy app).
6. Regularly review users and remove unused users and permissions.