Skip to main content

ITOps Agent - AWS IAM Service Account Provisioning

Purpose: Step-by-step guide to provision a service account (beaksvc-itops) for the Beak ITOps AI agent to perform basic AWS IAM user lifecycle management operations.

Scope: Create User, Update User Info, Password/Credential Reset

Estimated Time to Complete: 2-3 hours (including testing)

Executive Summary​

This document provides a condensed, action-oriented guide to:

  1. Create an AWS IAM service account (beaksvc-itops)
  2. Attach minimal required permissions via a custom IAM policy
  3. Generate API access keys for Beak agent integration
  4. Enable audit logging via CloudTrail
  5. Validate the setup with quick tests
  6. Hand off credentials to Beak implementation team

Prerequisites​

Before starting, ensure you have:

  • ✅ AWS account with administrative access
  • ✅ Permission to create IAM users and policies
  • ✅ Permission to enable CloudTrail
  • ✅ Secure storage for access keys (AWS Secrets Manager or credential vault)
  • ✅ AWS account ID (12-digit number): __________________

Step 1: Create IAM Service Account​

Time: 15 minutes

1.1 Access AWS IAM Console​

  1. Log into AWS Management Console
  2. Navigate to IAM service
  3. In the left sidebar, click Users
  4. Click Create user button

1.2 Configure User Details​

  1. User name: Enter beaksvc-itops
  2. Provide user access to the AWS Management Console: Leave UNCHECKED (programmatic access only)
  3. Click Next

1.3 Set Permissions​

  1. On the "Set permissions" page, select Attach policies directly
  2. Do NOT attach any policies yet (we'll create a custom policy in Step 2)
  3. Click Next

1.4 Review and Create​

  1. Review the configuration
  2. Click Create user
  3. ✓ Service account beaksvc-itops created successfully

Step 2: Create Custom IAM Policy​

Time: 20 minutes

2.1 Navigate to Policy Creation​

  1. In AWS Management Console, go to IAM > Policies
  2. Click Create policy button
  3. Click the JSON tab

2.2 Add Policy Document​

Copy and paste the following JSON policy. Replace ACCOUNT_ID with your 12-digit AWS account ID:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowCreateUser",
            "Effect": "Allow",
            "Action": [
                "iam:CreateUser",
                "iam:CreateAccessKey",
                "iam:CreateLoginProfile"
            ],
            "Resource": "arn:aws:iam::ACCOUNT_ID:user/itops/*"
        },
        {
            "Sid": "AllowUpdateUserAttributes",
            "Effect": "Allow",
            "Action": [
                "iam:UpdateUser",
                "iam:TagUser",
                "iam:UntagUser",
                "iam:GetUser",
                "iam:ListUserTags"
            ],
            "Resource": "arn:aws:iam::ACCOUNT_ID:user/itops/*"
        },
        {
            "Sid": "AllowPasswordReset",
            "Effect": "Allow",
            "Action": [
                "iam:UpdateAccessKey",
                "iam:CreateAccessKey",
                "iam:DeleteAccessKey",
                "iam:GetAccessKeyLastUsed",
                "iam:ListAccessKeys"
            ],
            "Resource": "arn:aws:iam::ACCOUNT_ID:user/itops/*"
        },
        {
            "Sid": "AllowGroupManagement",
            "Effect": "Allow",
            "Action": [
                "iam:AddUserToGroup",
                "iam:RemoveUserFromGroup",
                "iam:GetGroup",
                "iam:ListGroupsForUser"
            ],
            "Resource": [
                "arn:aws:iam::ACCOUNT_ID:user/itops/*",
                "arn:aws:iam::ACCOUNT_ID:group/itops/*"
            ]
        },
        {
            "Sid": "AllowListAndRead",
            "Effect": "Allow",
            "Action": [
                "iam:ListUsers",
                "iam:ListGroups",
                "iam:ListPolicies",
                "iam:GetUserPolicy",
                "iam:ListUserPolicies",
                "iam:ListAttachedUserPolicies"
            ],
            "Resource": "*"
        }
    ]
}

2.3 Review and Create Policy​

  1. Click Next
  2. Policy name: BeakIAMUserManagement
  3. Description: Service account policy for Beak ITOps agent to manage IAM users and credentials
  4. Click Create policy
  5. ✓ Policy BeakIAMUserManagement created successfully

Step 3: Attach Policy to Service Account​

Time: 10 minutes

3.1 Navigate to User​

  1. Go to IAM > Users
  2. Click beaksvc-itops

3.2 Attach Policy​

  1. Click the Permissions tab
  2. Click Add permissions > Attach policies directly
  3. Search for BeakIAMUserManagement
  4. Select the checkbox next to the policy name
  5. Click Add permissions

3.3 Verify​

  1. Confirm the policy appears in the "Permissions" section
  2. ✓ Policy attached successfully

Step 4: Generate Access Keys​

Time: 10 minutes

4.1 Create Access Key​

  1. On the beaksvc-itops user page, click Security credentials tab
  2. In the "Access keys" section, click Create access key
  3. Select Application running outside AWS
  4. Click Next
  5. (Optional) Description: Beak ITOps AI Agent - IAM Management
  6. Click Create access key

4.2 Save Credentials Securely​

⚠️ IMPORTANT: These credentials will only be shown once. Save them immediately.

  1. Copy Access Key ID → Save to secure location
  2. Copy Secret Access Key → Save to secure location
  3. Recommended: Store in AWS Secrets Manager or credential vault

DO NOT:

  • ❌ Share via email or chat
  • ❌ Commit to code repositories
  • ❌ Store in plain text files
  • ❌ Take screenshots unencrypted

4.3 Verify Access Key​

  1. Check the status shows Active
  2. Note the creation date
  3. ✓ Access keys generated and secured

Step 5: Enable CloudTrail Audit Logging​

Time: 15 minutes

5.1 Navigate to CloudTrail​

  1. Go to CloudTrail service
  2. Click Create trail (or use existing trail)

5.2 Configure Trail​

  1. Trail name: beaksvc-itops-audit
  2. S3 bucket: Create new bucket or use existing: cloudtrail-logs-ACCOUNT_ID
  3. Enable CloudTrail log file validation: ✅ CHECKED
  4. Include global service events: ✅ CHECKED
  5. Click Create trail

5.3 Verify CloudTrail Status​

  1. Navigate to CloudTrail > Trails
  2. Confirm trail Status: Logging is ON
  3. ✓ CloudTrail enabled for audit logging

Step 6: Quick Validation Tests​

Time: 30 minutes

Test 1: Verify Access Key Works​

  1. On your local machine, configure AWS CLI with the access key:
aws configure
# Enter: Access Key ID
# Enter: Secret Access Key
# Enter: Region (e.g., us-east-1)
# Enter: Output format (e.g., json)
  1. Run a simple test command:
aws iam list-users
  1. Expected Result: List of users returned without errors
  2. Status: ✅ PASS / ❌ FAIL

Test 2: Create Test User​

  1. Run:
aws iam create-user --user-name test-user-itops-001
  1. Verify in AWS Console: IAM > Users > Confirm test-user-itops-001 appears
  2. Status: ✅ PASS / ❌ FAIL

Test 3: Update User Attributes​

  1. Run:
aws iam tag-user --user-name test-user-itops-001 --tags Key=Environment,Value=Testing
  1. Verify: Get the user details and confirm tag appears
  2. Status: ✅ PASS / ❌ FAIL

Test 4: Create Access Key (Password Reset)​

  1. Run:
aws iam create-access-key --user-name test-user-itops-001
  1. Verify: New access key created with status "Active"
  2. Status: ✅ PASS / ❌ FAIL

Test 5: Verify CloudTrail Logging​

  1. Go to CloudTrail > Event history
  2. Filter by Username: beaksvc-itops
  3. Verify events logged:
    • ✅ CreateUser
    • ✅ TagUser
    • ✅ CreateAccessKey
  4. Status: ✅ PASS / ❌ FAIL

Cleanup​

  1. Delete test user:
aws iam delete-access-key --user-name test-user-itops-001 --access-key-id <KEY_ID>
aws iam delete-user --user-name test-user-itops-001

All 5 tests must PASS before proceeding to handoff

Step 7: Provide Credentials to Beak Implementation Team​

Time: 10 minutes

Gather and securely provide the following information:

Required Credentials​

AWS Account ID:           __________________
Service Account Username: beaksvc-itops
Access Key ID:            __________________
Secret Access Key:        __________________
Primary AWS Region:       __________________

Policy Information​

Policy Name:              BeakIAMUserManagement
Policy ARN:               arn:aws:iam::ACCOUNT_ID:policy/BeakIAMUserManagement
User Path Scope:          /itops/*

Audit & Compliance​

CloudTrail Trail Name:    beaksvc-itops-audit
S3 Bucket for Logs:       cloudtrail-logs-ACCOUNT_ID
Log File Validation:      Enabled ✓

Operational Details​

Allowed Operations:       Create User, Update User Info, Reset Credentials
User Path:                /itops/* (only users matching this path)

Delivery Method:

  • Encrypt credentials before sending
  • Use secure file transfer or password-protected document
  • Deliver in separate communication channel from attachments
  • Confirm receipt from Beak team

Step 8: Security Checkpoints​

Before handoff, verify:

  • beaksvc-itops IAM user exists
  • BeakIAMUserManagement policy is attached
  • Access keys generated and stored securely
  • CloudTrail enabled and logging
  • All 5 validation tests PASSED
  • Credentials stored in secure location (Secrets Manager, vault, etc.)
  • No other access keys exist for this user
  • Console login disabled for this account
  • Approval documentation complete

Troubleshooting​

IssueSolution
Access Denied creating userVerify BeakIAMUserManagement policy is attached to beaksvc-itops
Can't generate access keyEnsure beaksvc-itops is enabled and no access key restrictions exist
CloudTrail not loggingVerify S3 bucket exists and has write permissions for CloudTrail
Access key not workingVerify access key is Active (not Inactive), correct region specified
Policy permissions errorReplace ACCOUNT_ID with actual 12-digit account ID in policy JSON

Quick Reference​

Service Account Details​

Account Name:        beaksvc-itops
Account Type:        IAM User (programmatic access)
Console Access:      None
CloudTrail Logging:  Enabled

IAM Policy​

Policy Name:         BeakIAMUserManagement
Scope:              /itops/* (configurable)
Least Privilege:    Yes
Operations:
  ✓ Create users
  ✓ Update user attributes
  ✓ Reset credentials
  ✓ Manage group membership
  ✗ Create roles
  ✗ Modify role policies

Summary​

You have successfully:

✅ Created AWS IAM service account beaksvc-itops
✅ Created and attached custom IAM policy
✅ Generated API access keys
✅ Enabled CloudTrail audit logging
✅ Validated setup with 5 tests
✅ Documented credentials for handoff

Beak ITOps agent is ready to begin automated AWS IAM user management!