User Management

Log in to the console https://console.aws.amazon.com/console/home?region=us-east-1

1. Go to IAM service https://console.aws.amazon.com/iam/
2. Go to Users https://console.aws.amazon.com/iam/home#/users
3. Click Add user
4. Provide a user name. On the access type pick AWS Management Console access and specify a password for the user
5. Permissions
   1. Admin: On the next tab, that provides permissions select Copy permissions from existing user and pick mkosinski or smusch user if you want this user to be an Admin
   2. External programmer: On the next tab, that provides permissions select Attach existing policies directly and select the Policy that enables to work only with specific S3 bucket, if you want this user to be just a Worker, like an external programmer. (This policy needs to exist prior to this step. The creation is described in the next chapter).
6. Keep clicking next, until the new user is done
7. New user can load through https://895465320602.signin.aws.amazon.com/console

The main use case here is to limit access for external contractors (like external programmers) to specific folders.

1. Go to Policies

2. Click Create policy

3. Pick JSON format

4. Put this JSON (fill 3 places for a directory name/ DIR_NAME) that allows to work with specific directory inside the monorepo-data S3 Bucket

5. Click Review policy and change DIR_NAME from the below to the actual directory name

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "AllowUserToSeeBucketListInTheConsole",
               "Action": [
                   "s3:ListAllMyBuckets",
                   "s3:GetBucketLocation"
               ],
               "Effect": "Allow",
               "Resource": [
                   "arn:aws:s3:::*"
               ]
           },
           {
               "Sid": "AllowRootAndHomeListingOfCompanyBucket",
               "Action": [
                   "s3:ListBucket"
               ],
               "Effect": "Allow",
               "Resource": [
                   "arn:aws:s3:::monorepo-data"
               ],
               "Condition": {
                   "StringEquals": {
                       "s3:prefix": [
                           "",
                           "DIR_NAME/"
                       ],
                       "s3:delimiter": [
                           "/"
                       ]
                   }
               }
           },
           {
               "Sid": "AllowListingOfUserFolder",
               "Action": [
                   "s3:ListBucket"
               ],
               "Effect": "Allow",
               "Resource": [
                   "arn:aws:s3:::monorepo-data"
               ],
               "Condition": {
                   "StringLike": {
                       "s3:prefix": [
                           "DIR_NAME/*"
                       ]
                   }
               }
           },
           {
               "Sid": "AllowAllS3ActionsInUserFolder",
               "Effect": "Allow",
               "Action": [
                   "s3:*"
               ],
               "Resource": [
                   "arn:aws:s3:::monorepo-data/DIR_NAME/*"
               ]
           }
       ]
   }
   

6. Click Create policy after you invent a name

1. At the IAM Service list Users select the specific user and click Add permissions
2. Select Attach existing policies directly and pick the Policy from the list
3. Click Review and Add permissions