DevOps Bootcamp · Lesson

Managing S3 Buckets and IAM

Learn to provision and configure S3 storage buckets and manage AWS Identity and Access Management (IAM) resources with Terraform.

Managing S3 Buckets and IAM is a free DevOps Bootcamp lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the DevOps Bootcamp learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

S3 & Terraform: Cloud Storage

Amazon S3 (Simple Storage Service) offers highly scalable, durable, and available object storage. It's perfect for backups, static websites, and data archiving.

Managing S3 buckets with Terraform brings several benefits:

Automation: Create and configure buckets programmatically.
Version Control: Track changes to your bucket configurations.
Consistency: Ensure all environments have identical S3 setups.

Your First S3 Bucket

Let's define a simple S3 bucket. The aws_s3_bucket resource is used for this.

Bucket names must be globally unique across all AWS accounts. Choose a unique name!

Try running this example:

resource "aws_s3_bucket" "my_unique_bucket" {
  bucket = "my-coddykit-unique-bucket-12345" # Replace with a globally unique name
}

output "bucket_id" {
  value = aws_s3_bucket.my_unique_bucket.id
}

Bucket Naming & Region

When creating an S3 bucket, remember these key points:

Global Uniqueness: Bucket names must be unique across all AWS accounts globally.
Region: While names are global, the bucket itself resides in a specific AWS region (defined by your AWS provider config).
Naming Rules: Names must be lowercase, 3 to 63 characters long, and can contain hyphens.

Choosing a good naming convention is essential for organization and clarity.

S3 Security & Features

S3 offers features like versioning to keep multiple versions of an object, and public access blocks for security. It's crucial to block public access by default for most buckets.

This example sets up versioning and ensures public access is blocked.

Try running this example:

resource "aws_s3_bucket" "my_versioned_bucket" {
  bucket = "coddykit-versioned-bucket-98765" # Replace with a unique name
}

resource "aws_s3_bucket_versioning" "my_versioned_bucket_versioning" {
  bucket = aws_s3_bucket.my_versioned_bucket.id
  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_public_access_block" "my_versioned_bucket_public_access_block" {
  bucket = aws_s3_bucket.my_versioned_bucket.id

  block_public_acls       = true
  block_public_and_cross_account_access = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

output "bucket_name_versioned" {
  value = aws_s3_bucket.my_versioned_bucket.bucket
}

AWS IAM: Identity & Access

AWS IAM (Identity and Access Management) is a web service that helps you securely control access to AWS resources. It's fundamental for security.

With IAM, you can:

Manage users and their programmatic/console access.
Grant granular permissions to specific AWS resources.
Control who can do what in your AWS account.

Terraform allows you to define and manage IAM resources just like S3 buckets.

Provisioning an IAM User

Let's create a new IAM user using Terraform. An IAM user represents a person or service that interacts with AWS.

This user won't have any permissions yet; we'll add those next.

Try running this example:

resource "aws_iam_user" "coddykit_user" {
  name = "coddykit-app-user"
  path = "/system/"
  tags = {
    Department = "DevOps"
  }
}

output "iam_user_name" {
  value = aws_iam_user.coddykit_user.name
}

output "iam_user_arn" {
  value = aws_iam_user.coddykit_user.arn
}

Understanding IAM Policies

IAM policies are documents that define permissions. They specify what actions are allowed or denied on which resources, and under what conditions.

Policies are written in JSON and can be attached to users, groups, or roles.

Identity-based policies: Attached to an IAM identity (user, group, role).
Resource-based policies: Attached to a resource (like an S3 bucket or SQS queue).

Granting S3 Permissions

Now, let's create a policy that grants our IAM user read-only access to a specific S3 bucket, and then attach it.

The aws_iam_policy resource defines the policy, and aws_iam_user_policy_attachment links it to the user.

Try running this example:

resource "aws_s3_bucket" "policy_target_bucket" {
  bucket = "coddykit-policy-bucket-112233" # Unique name
}

resource "aws_iam_user" "s3_reader_user" {
  name = "coddykit-s3-reader"
}

data "aws_iam_policy_document" "s3_read_only_policy" {
  statement {
    actions = [
      "s3:GetObject",
      "s3:ListBucket"
    ]
    resources = [
      aws_s3_bucket.policy_target_bucket.arn,
      "${aws_s3_bucket.policy_target_bucket.arn}/*"
    ]
  }
}

resource "aws_iam_policy" "s3_read_only" {
  name        = "CoddyKitS3ReadOnlyPolicy"
  description = "Grants read-only access to a specific S3 bucket"
  policy      = data.aws_iam_policy_document.s3_read_only_policy.json
}

resource "aws_iam_user_policy_attachment" "attach_s3_read_only" {
  user       = aws_iam_user.s3_reader_user.name
  policy_arn = aws_iam_policy.s3_read_only.arn
}

output "s3_reader_user_name" {
  value = aws_iam_user.s3_reader_user.name
}

output "s3_read_only_policy_arn" {
  value = aws_iam_policy.s3_read_only.arn
}

Organizing with IAM Groups

For better management, especially with many users, you can use IAM groups. A group is a collection of IAM users.

Instead of attaching policies to individual users, you can attach policies to a group, and all users in that group inherit those permissions.

This simplifies permission management and follows the principle of least privilege more easily.

Quick Check: S3 & IAM

Which of the following statements about managing AWS S3 buckets and IAM users/policies with Terraform are TRUE?

Recap: S3 and IAM

Great job! In this lesson, you learned how to manage AWS S3 buckets and IAM resources using Terraform.

We provisioned S3 buckets, configured versioning, and blocked public access.
We created IAM users and attached custom policies to grant specific permissions.
You now understand the importance of S3 for storage and IAM for secure access control in AWS, all defined as code!

Next up, we'll dive into advanced state management techniques.

Frequently asked questions

Is the “Managing S3 Buckets and IAM” lesson free?

Yes — the full text of “Managing S3 Buckets and IAM” is free to read here on the web, and the DevOps Bootcamp course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the DevOps Bootcamp course, upgrade to CoddyKit PRO.

What will I learn in “Managing S3 Buckets and IAM”?

Learn to provision and configure S3 storage buckets and manage AWS Identity and Access Management (IAM) resources with Terraform. You practise DevOps Bootcamp with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start DevOps Bootcamp?

No prior experience is required. DevOps Bootcamp on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Managing S3 Buckets and IAM” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this DevOps Bootcamp lesson?

Yes. Every DevOps Bootcamp lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to DevOps Bootcamp