# AWS Setup for E192-08 (PET)

This guide documents the AWS setup for PET, following best practices for small research institutions. It covers IAM users, groups, policies, security groups (firewall rules), access controls, and typical usage patterns.

---

## Basic Structure

### AWS Account:
- Root account exists but is **not used for daily work**
- Central management via IAM user: `admin-setup`
- IAM users are assigned to groups

### User Groups:

| Group           | Purpose                                 |
|------------------|------------------------------------------|
| `TechAdmins`     | Full access to all resources             |
| `FinanceAdmins`  | Billing & budget access                  |
| `ResearchStaff`  | Full research capability (e.g., EC2)     |
| `Students`       | Limited EC2 access                       |
| `Guests`         | Read-only access                         |
| `Alumnis`        | Access to archived S3 data               |

---

## Example Users

| Username   | Groups                                 |
|------------|------------------------------------------|
| `pgerhart` | ResearchStaff                            |
| `tchu`     | ResearchStaff                            |
| `dschroed` | TechAdmins                               |
| `mgruenin` | ResearchStaff                            |
| `dlicalsi` | ResearchStaff                            |
| `jstrasse` | TechAdmins                               |
| `ykleindi` | FinanceAdmins                            |

---

## ? IAM Policies

### ResearchStaff (simplified):

- Start, stop, terminate EC2 instances
- Manage EBS volumes and snapshots
- Manage own key pairs
- No access to critical networking components
- Allowed IAM actions for password & MFA management

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowEC2BasicActions",
      "Effect": "Allow",
      "Action": [
        "ec2:Describe*",
        "ec2:StartInstances",
        "ec2:StopInstances",
        "ec2:RebootInstances",
        "ec2:RunInstances",
        "ec2:TerminateInstances",
        "ec2:CreateTags",
        "ec2:CreateVolume",
        "ec2:AttachVolume",
        "ec2:DetachVolume",
        "ec2:DeleteVolume",
        "ec2:CreateSnapshot",
        "ec2:DeleteSnapshot"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowOwnKeyPairs",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateKeyPair",
        "ec2:DeleteKeyPair",
        "ec2:ImportKeyPair"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowSecurityGroupLookups",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeSecurityGroups",
        "ec2:GetSecurityGroupsForVpc"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ExplicitDenyDangerousStuff",
      "Effect": "Deny",
      "Action": [
        "ec2:DeleteSecurityGroup",
        "ec2:DeleteVpc",
        "ec2:DeleteInternetGateway",
        "ec2:DeleteSubnet",
        "ec2:DeleteRouteTable",
        "ec2:DetachInternetGateway"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowSafeIAMSelfActions",
      "Effect": "Allow",
      "Action": [
        "iam:ChangePassword",
        "iam:GetAccountPasswordPolicy",
        "iam:GetUser",
        "iam:ListVirtualMFADevices",
        "iam:EnableMFADevice",
        "iam:ResyncMFADevice",
        "iam:DeactivateMFADevice",
        "iam:DeleteVirtualMFADevice",
        "iam:ListMFADevices"
      ],
      "Resource": "*"
    }
  ]
}
```

Other policies (for Students, Guests, FinanceAdmins, Alumnis) follow the same structure with tailored permissions.

---

## Security Groups

 Security groups in AWS are region-specific and therefore need to be copied to the region in which they are being used.

### 1. `open-common-ports`

Intended for general use by researchers and students. Allows global access for web and SSH.

**Inbound:**

| Protocol | Port | Source IPv4   | Source IPv6 |
|----------|------|----------------|-------------|
| TCP      | 22   | `0.0.0.0/0`    | `::/0`      |
| TCP      | 80   | `0.0.0.0/0`    | `::/0`      |
| TCP      | 443  | `0.0.0.0/0`    | `::/0`      |

**Outbound:** All traffic allowed.

---

### 2. `open-TUips-allports`

Full access from trusted TU networks.

**Inbound:**

| Protocol | Port | Source                     |
|----------|------|----------------------------|
| All      | All  | `192.35.240.0/22` (ACOnet) |
| All      | All  | `128.130.0.0/15` (TU Wien) |
| All      | All  | `2001:629::/32` (IPv6)     |

**Outbound:** All traffic allowed.

---

## Testing & Tools

- IAM Policy Simulator: https://policysim.aws.amazon.com/
- CLI tests:
  ```bash
  aws ec2 describe-instances
  aws ec2 describe-volumes
  aws s3api list-buckets
  ```

---

## ? Example User Access

> **Login URL:**  
> https://222634361097.signin.aws.amazon.com/console  
>  
> **Username:** jstrasse  
> **Password:** ********  
>