IAM, ACCOUNTS AND AWS ORGANISATIONS

[ASSOCIATE] IAM Identity Policies (15:52)

Alt text IAM Policy Document

Alt text DENY - ALLOW - DENY

Alt text All policies for IAM Identities (User, Role, Group) & AWS Resources are evaluated at the same time.

Alt text Inline Policy vs Managed Policy

[ASSOCIATE] IAM Users and ARNs (13:49)

alt text IAM User - What is it?

Alt text IAM - Principal and Authenticated Identity

what is a principal?

Principal is an entity in AWS that can perform actions and access resources.

Alt text IAM Users - Limitation

what is the limit iam users per account?

5.000 IAM Users per AWS account

how many iam groups a iam user can be a member of?

10 IAM groups per IAM User

Alt text ARNs

what is the format of arn?

arn:partition:service:region:account-id:resource-id
arn:partition:service:region:account-id:resource-type/resource-id
arn:partition:service:region:account-id:resource-type:resource-id

👉

5 to 6 colon :
region or/and account-id can be omitted.

arn	partition	service	region	account-id	resource-type	resource-id
	`aws` `aws-cn` `aws-us-gov`	`iam` `s3` `ec2` …	`us-east-1` `ap-southest-1` …		`user`

[ASSOCIATE, DEMO] Simple Identity Permissions in AWS (16:06)

[ASSOCIATE] IAM Groups (7:48)

Alt text IAM Groups

what is iam group?

Containers for IAM Users.

what are the limits of iam group?

No Nesting.
Limit of 300 Groups.

Alt text IAM Group is not a true identity

can an iam group be used as a principle in a policy?

IAM Group is NOT a true identity, that

can NOT be used as a Principle in a policy.
don’t have credential to login with

[ASSOCIATE, DEMO] Permissions control using IAM Groups (9:24)

[ASSOCIATE] IAM Roles - The Tech (8:13)

Alt text IAM Role and Assuming an IAM Role

Alt text Trust Policy vs Permission Policy

what is trust policy in iam?

The trust policy defines

which principals can assume the role, and
under which conditions

See How to use trust policies with IAM roles | AWS Security Blog

[ASSOCIATE] When to use IAM Roles (15:27)

Alt text Lambda Execute Role

Alt text Emergency Role

Alt text Existing Identities (e.g. Active Directory)

Alt text Web Identities (e.g. Google, Facebook)

Alt text AWS Partner Accounts

Service-linked Roles & PassRole (5:16)

Alt text Service-linked Roles

what is service-linked role?

A service-linked role is

a unique type of IAM role that is linked directly to an AWS service.
predefined (by the service) to include all the permissions that the service requires (to call other AWS services on your behalf).

why use service-linked role?

A service-linked Role

simplify the process of setting up a service because
- you don’t have to manually add permissions for the service to complete actions on your behalf
may be created
- automatically (by the service)
- manually using a wizard in the console
- manually using IAM

See Create a service-linked role

Alt text Permissions to allow create/edit the service-linked role

Alt text Pass an existing role to the service

[ASSOCIATE] AWS Organizations (12:56)

alt text “Standard” AWS Account

Alt text Management/Master Account

aws organization and management account, which come first?

First, you use a standard account to create an AWS Organization
Then that standard account become the management account of the AWS Organization.

Alt text Invite existed standard accounts to an AWS Organization

Alt text Accepting invitations to become member of an AWS Organization

Alt text Member Accounts

Alt text Organization Root & Organization Unit (OU)

Alt text Consolidated Billing

Alt text Role Switching

[ALL, DEMO] AWS Organizations (19:48)

alt text Create an account in your organization

how to access an aws account in an aws organization?

Using username/password of that AWS account to access that AWS account using its root user
Using another account to switch role to that account’s IAM role OrganizationAccountAccessRole
Using the AWS access portal with corporation credentials (Google, Facebook…)

[ASSOCIATE] Service Control Policies (SCPs) (12:44)

Alt text Service Control Policies (SCP)

Alt text SCP controls account permissions in an organization

what does service control policies (scp) do?

SCP

restricts permissions for
- IAM users
- IAM roles
- including root user
in member accounts.
(do NOT grant permissions)

Alt text SCP - Deny List

sgp - deny list strategy

With deny list strategy, all permissions are allowed unless explicitly denied.

This is the default behavior of AWS Organizations.

By default, AWS Organizations attaches an AWS managed policy called FullAWSAccess to all roots, OUs, and accounts.
You
- leave the default FullAWSAccess policy in place (that allow “all”).
- then attach additional policies that explicitly deny access to the unwanted services and actions.

Alt text SCP - Allow List

sgp - allow list strategy

With allow list strategy, all permissions are denied unless explicitly allowed.

By default, AWS Organizations attaches an AWS managed policy called FullAWSAccess to all roots, OUs, and accounts.
You
- remove the default FullAWSAccess policy
- then attach additional policies that explicitly allow access to the wanted services and actions

Alt text Identity Policies and SCPs