shib-ec2emr

shib-ec2emr

This directory contains several CloudFormation templates.

ec2emr-iam-resources.yaml

This CloudFormation template creates:

• IAM policies for nearly full access to EC2 and and EMR services
• IAM policy for self-management of password, MFA, and access keys
• IAM role that grants access via Cornell SSO
• IAM group that grants that access to IAM users

Creating IAM users in the AWS Console - OUTLINE

(Based on https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html.)

1. Sign into the console: https://console.aws.amazon.com/iam/
2. Users -> Add User
3. Add email address of target user as the sign-in name.
4. Add additional users, if required
5. Select AWS Management Console access
6. Select autogenerated password
7. Require password Reset
8. Next: permissions
9. Add user to Group
10. select ec2emr-users
11. Skip permissions boundary
12. Next: Review
13. download CSV with credentials
14. Securely distribute user names and password to users.

• DO NOT email passwords

Instructions for new IAM users to configure their Account

(Starts with getting their iam sign-in name and password from account admin.)

1. Login at CUSTOM URL
2. Password change (forced)
3. set MFA
4. Logout
5. Login with MFA