Clash Royale CLAN TAG#URR8PPP

IAM Roles and EC2 access to user identity

I was checking out videos on accessing aws using ssh.

He just added a IAM role while creating EC2 instance. When I ssh to EC2 instance from cli I was easily able to run "aws s3 ls". My question is how does it will know whether I belong to that IAM role or not?

While starting ssh connection I gave only the public IP of EC2 and keypair related to that EC2 instance.

So where exactly I allowed my identity to be shared with aws?

When I didnot added the role while creating ec2 instance I have to explicitly give my keys for accessing aws services.

So what IAM role do on the fly that it donot ask for credentials?

2 Answers
2

First don't interrelate PEM(keypair) and IAM. Both are not connected each other.

What is IAM?

AWS Identity and Access Management (IAM) enables you to manage access
to AWS services and resources securely.

From the explanation itself it's clear that that, it enables access to AWS resources. So lets take one simple example, you want to access S3 Bucket from the AWS EC2 Instance you created. For that you need to provide Accesskey and Secretkey, From where you will get the access key and secret key, which can be generated by creating a User/Role using IAM. Both have the Creds generated. Now lets see abot Role. Role can be assumed by a USER/Resource(EC2), now if you assign a Role to a EC2 then the Instance by default will get all the permissions associated with that role, means it gets the Accesskey and SeceretKey. Now if you ran some aws s3 ls command then it will retrieve the keys from the default path and access the AWS Resource(here S3).

Accesskey

Secretkey

aws s3 ls

What is EC2 Keypair(PEM)?

Amazon EC2 uses public–key cryptography to encrypt and decrypt login
information. Public–key cryptography uses a public key to encrypt a
piece of data, such as a password, then the recipient uses the private
key to decrypt the data. The public and private keys are known as a
key pair.

The Keypair is only associated with your EC2 instance and it can't be used to access any other AWS resources. It has no dependency with IAM. You are not sharing any identity with AWS. The private key is owned by you(PEM file) and the public key is kept inside the EC2 instance in this file ~/.ssh/authorized_keys . If you want to change your keys and delete the Amazon provided keypair, just delete the default one and place the new public key in the above file. Now you can use the new keypair to login to your instance.

~/.ssh/authorized_keys

Thus your keypair and IAM are not interconnected anywhere. For more details

AWS EC2 Keypair

AWS IAM Docs

The IAM role is assigned to the entire EC2 instance. Any code running on that EC2 instance gets the IAM role. The IAM role is completely unrelated to the SSH account you use to login to the EC2 instance.

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.