- [Alana] Now that you're an expert in reading policies, you need to learn how to create them. In this video I'll show you some helpful tools to create both identity and resource policies. If you're creating an identity policy for a user, group or role, an easy way to do this is by using the policy creation feature in the IAM console. To use this, I'll click on Policies in the console, and then I'll click on Create Policy. Here you create a policy one of two ways. The first is you can use the visual editor that will guide you through the process of creating a policy step-by-step, and the second way is by creating and editing the JSON in a code editor, and then pasting it into this tab. If you're just getting started with IAM, you may find the visual editor is easier to use. It has a nice UI and abstracts the code, so you don't need to know any JSON in order to do this. Here's how it works. Let's say I want to allow my identity to access an object in S3. The first thing I choose is the service I want to allow or deny access to. Any service that IAM integrates with is listed here. Since I want my identity to access S3, I'll go ahead and find S3 in the list and then select it. Notice that when I choose the service, I'm prompted to select the actions I want to allow. I could also switch to a deny menu by clicking here, where I can select the actions I then want to deny. But since I want to allow access to S3, I'm going to go ahead and switch back to the allow menu. In this menu, the actions or API calls you select are categorized by access level. I want my identity to read a particular object, so I'll need to expand the Read category and then select GetObject. Once I'm done selecting all the actions I want my identity to make, I can then move on to the resources section. This is where I select the resource I want to allow access to. In this case, the resource is the particular S3 object I want my identity to read. In some scenarios, I may want my identity to read any object in Amazon S3. For this, I can toggle the all resources button. However, if I just want them to access a specific S3 object, like in this scenario, I can do this by toggling specific and then specifying the ARN of my object. To do this, I'll click on add ARN and then type in the bucket name and the object name, and then clicking add. After that, I'll move on to the conditions section. This is an optional section, but it enables me to customize my policy further. For example, if I want my identity to only access this object from a particular source IP address, I can click source IP and then input my IP address. I can also restrict this with IP ranges. So if I only want my identity to access this particular object from my corporate network range, I can input that as well. Once I've finished with this section, I can add additional statements to this policy by clicking add additional permissions. However, since I only want to allow access to a particular object, I'm done here, so I'll remove this and then click review policy. In this screen I'll go ahead and give my policy a name and description. In this case, I'm just going to call it my demo policy, and then put in my initials and put in three. For my description, I'll also put in demo, and then I'll click create policy. So now I've successfully built an identity policy. It exists in my console and I can attach it to any IAM user, group or role. But what about creating a resource policy? Unlike identity policies, there's no easy way to create them from inside the AWS Management Console. However, there is an external tool called the AWS Policy Generator that offers a similar guided approach to policy creation. Let's use this tool to create a resource policy for S3, also known as an S3 bucket policy. In this resource policy, I'll want to allow my developer role to have read only access to the objects in my bucket. The first step is I'll select my policy type in this tool. From here, I'll go ahead and select S3 Bucket Policy. Then to create my first statement, I'll go ahead and decide if I want the effect to be allow or deny. In this case, I want to allow access to my developer, so I'll go ahead and leave it as allow. The next thing I choose is the principles. This is where I decide who I want to have access to my S3 bucket. I do this by specifying the ARN for the principal or by using a wildcard. In this case I'll go ahead and paste my developer roles ARN. Next I choose the actions I want my role to be able to take on the S3 bucket. I want the developer to get all the objects in a bucket, so I'm going to go ahead and select the GetObject action. And then finally, I choose which resource, in this case, which S3 objects I'm allowing my developer to perform the API call on. To do this, I'll paste in the ARN, and then I'll add a slash and a wildcard to the end of it. This specifies that the developer can read all objects inside this bucket. Moving on, I can also optionally add conditions by clicking here, just as I could in the console. However, I'm done with this policy, so I'll click add statement, and then I'll click generate policy. To use this policy, I'll simply copy the JSON, and then I'll paste it into the service I want to apply this resource policy to. In this case I'll go back to the console, find Amazon S3 in the services lists. I'll click on the bucket that I created for this policy. I'll click on the permissions tab, click on bucket policy, and then I'll go ahead and paste this in, remove the space I added and then click save. Now these step-by-step visual editors can feel tedious once you become more familiar with the policy language. Eventually, you may want to bypass using these GUI type editors and create and edit the JSON directly. In fact, this is my favorite way of creating policies. But when I do this, I almost never start with just a blank code editor. Instead, I like to use a starting policy. So I like to go to the AWS documentation and find policy code snippets that look similar to what I want my policy to look like, then I edit the policy to match my use case. For example, if I want to allow read access to an S3 bucket, I'll find the S3 service by using Control-F to find S3, and then I'll select a code snippet that looks similar to what I want to do. In this case, I can use the allow read and write access to a specific Amazon S3 bucket policy. I'll click view this policy, and then I can copy this to my code editor and edit it how I please. So now you have the three methods of creating policies. The console for creating identity policies, the AWS Policy Generator for creating resource policies, and then last but not least, editing the JSON directly. That's it for this one, thanks everyone and I will see you soon.
