‫Okay, so sometimes
‫we just want to make sure we have the permissions
‫and we can't really look
‫at the IAM policies for whatever reason.
‫We actually don't want to run the command.
‫We just want to make sure we have the permissions.
‫And some AWS CLI commands such as the EC2 commands,
‫they can become quite expensive if they succeed.
‫Because, say we wanted to create an EC2 instance,
‫and we actually create it,
‫we just wanted to try whether or not it worked.
‫So, these commands, but not all commands
‫may contain a minus minus dry-run option.
‫And that option is to simulate API calls.
‫If you don't have the permissions,
‫you'll get a denied exception and then you know.
‫But if you have the permissions,
‫you will just not run the command.
‫So, let's go ahead and practice this.
‫So, let's say we want to see
‫whether or not our EC2 instance,
‫with this IAM role, can create other EC2 instances.
‫That would be something fun to test, right?
‫But we actually don't want to create another EC2 instance,
‫we just want to make sure that it can create EC2 instances.
‫So let's have a look,
‫and look at the command.
‫So, for this it's called AWS EC2 run-instances.
‫And as you can see, I'm running this command
‫straight from my EC2 instance.
‫I'll make sure to run help,
‫because I wanna get help with this command.
‫And this command is quite a long one,
‫you can read the whole documentation,
‫it's also available online.
‫But for this I'll make it super simple for you:
‫we're going to need a few parameters
‫and we'll also add the dry-run parameter
‫just to test the command.
‫So let's do the dry-run,
‫and this is the first thing I'm going to specify,
‫because I want to make sure that whatever I do next,
‫it is going to be a dry-run.
‫Now, we have to specify an image-id.
‫An image-id is basically the AMI ID,
‫and for this we can just go to our EC2 instance,
‫click on the AMI ID that's already running,
‫and we can just get the AMI ID all the way from here.
‫We'll copy this whole thing,
‫and paste it.
‫Right here.
‫The next thing we have to do is to specify
‫the instance type.
‫And for the instance type, I will choose a t2.micro.
‫Now, this looks all right,
‫this is enough to run this command,
‫so I'll just click on Enter.
‫And we get "An error occurred (UnauthorizedOperation)".
‫So we are not authorized to perform this operation.
‫That's because we set up the dry-run command,
‫and so, basically, using this dry-run,
‫you were able to test whether or not
‫you have the authorization to do a thing.
‫Now, let's make something fun
‫and give ourselves the right to run instances.
‫So I'll go back to IAM,
‫I'll attach the policy that was managed from us before,
‫so let me just find it.
‫It is right here, I'll attach it.
‫And I will go and edit this policy,
‫so I'll go to policies, and right here, I'll click on it,
‫and I will edit this policy.
‫And using the visual editor
‫I will add additional permissions,
‫I'll choose a service that will be EC2.
‫So let's scroll down, EC2 is right here.
‫Now, we need to specify the permission.
‫So if we go back to this command,
‫we can see that the thing it tried to run
‫is called RunInstances.
‫So let's go to Write, because it is a write action,
‫and if we scroll down,
‫we can see that the RunInstances is right here.
‫Let's go back up to roll this whole menu.
‫So now we have the Write instance, one is selected,
‫and as you can see I only chose
‫the one operation I need to do,
‫I did not over-privilege my EC2 instance, okay?
‫Giving roles the minimum privilege they need to run is key.
‫Now, for the resources, it says
‫"You chose actions that require image resource type,
‫"et cetera, et cetera."
‫To make it very simple, I will just say "All resources",
‫and it will have a star right here.
‫Now, I can review the policy, and as you can see now,
‫I have my EC2 that has Limited Write access
‫for all resources.
‫Save the changes.
‫And we can also look at the JSON document.
‫And, as we can see now, we get an Allow on EC2:RunInstances
‫for all Resources.
‫So, my policy has been applied,
‫and now if I go back to my EC2 console, from my EC2 machine,
‫and try to run this command,
‫this time I get an error called a "DryRunOperation".
‫And it says, "Request would have succeeded,
‫"but the DryRun flag is set".
‫So that's perfect!
‫From this DryRun operation we ensured
‫that we had the rights to perform a RunInstance operation,
‫but it actually didn't succeed
‫because I have set up the dry-run flag.
‫And so we get this DryRunOperation exception.
‫And so that's good, this is how we test our API calls,
‫for some API calls it's important to dry-run flag.
‫As you can see, if they're denied, we get the
‫"UnAuthorizedOperation", if they are allowed, we get the
‫"DryRunOperation".
‫But in no cases was this new instance being run,
‫so that's helpful.
‫So this is all for this lecture,
‫in the next lecture we are going to try to understand
‫what the hell this error message means.
‫So see you in the next lecture.