4. [M] IAM, Accounts and AWS Organisations

IAM Identity Policies

• IAM policies attach to identities inside AWS
• Identities can be IAM users, groups, and roles
• Understanding IAM policies is crucial for AWS exams and solution implementation
• There are three stages to understanding policies:
  • Understanding their architecture and how they work
  • Gaining the ability to read and understand the policy
  • Learning to write them

IAM Policies as Security Statements

• IAM policies are sets of security statements in AWS.
• They grant or deny access to AWS features.
• Policies are created using JSON.
• Policy documents contain one or more statements.
• Statements grant or deny permissions to AWS services.

Statements, Authentication, and Authorization

• To access AWS resources, an identity needs to prove its identity through authentication.
• Authenticated identities are known as authenticated identities.
• AWS has a collection of all statements applicable to an identity.
• AWS knows which resources the identity is interacting with and the intended actions.
• AWS processes the statements to determine access.

Statement Components: SID and Actions

• A statement includes a statement ID (SID), an optional field for identifying a statement.
• Best practice is to use SIDs regardless of the policy document size.
• Interactions with AWS involve resources and the actions performed on them.
• A statement applies if the interaction matches the action and the resource.
• The action part of a statement matches one or more actions and can be specific.
• The format is service:operation, like s3:GetObject.

Actions (cont) and Resources

• Wildcards can match any operations (e.g., s3:*).
• Actions can be a list of individual actions.
• Resources are matched similarly, using individual ARNs, lists, or wildcards.
• Using wildcards refers to every resource.

Effects: Allow and Deny

• The effect determines what AWS does if the action and resource parts of a statement match.
• Effect can be either allow or deny.
• AWS will allow or deny access to resources depending on if the action.
• S3 statement matches, and effect is allow.
• Actions part of a statement matches.

Overlapping policies

• It is possible to be both allowed and denied at the same time.
• Explicit denies take precedence over explicit allows.
• If neither apply, the default implicit deny takes effect.
• AWS identities start with no access, except for the account root user.

Multiple Policies and Evaluation

• AWS collects all statements from applicable policies when an identity accesses a resource.
• This includes direct policies, group policies, and resource policies.
• The same deny, allow, deny rule applies.
• Explicit deny always wins. If no explicit deny, an explicit allow grants access, unless there is an explicit deny. If none, the default takes effect.

Inline vs Managed Policies

• JSON policy documents are the same for both inline and managed policies.
• The difference is how they are managed.
• With inline policies, change can be achieved on three access rights, with inline policies.
• The first being permission across the required resources for that project, this is known as an inline policy.
• Secondly, the use of the same managed policy can be useful for a large number of users or group roles, it will use managed policies for the default.
• Thirdly, managed policies are low management overhead.

AWS-Managed vs. Customer-Managed Policies

• AWS-managed policies are created and managed by AWS
• AWS-managed policies may not fit your exact business needs.
• Customer-managed policies are created and managed by the business.
• Customer-managed policies enables defining them as per business requirements.

Policy Usage

• Inline policies are suitable for special or exceptional circumstances.
• In special circumstances, you will likely want to use an inline policy.
• If it is not special circumstances, it will likely be AWS-managed policies.

IAM Users

• IAM Users are identities
• Used for long-term AWS access
• Examples include humans, applications, or service accounts
• If you need long-term access, you should select this
• 99% of the time, you would use an IAM user

IAM and Principal

• IAM starts with a principal, which is an entity trying to access on an AWS account
• Principals can be individual people, computers, services or a group of any of those things
• To authenticate and be authorized, the principal needs to authenticate and be authorized
• Principles and IAM makes requests with resources in mind
• An IAM user is an identity which can be used this way and authentication is the first step

Processes for Authentication

• Authentication- proving to IAM that the principal on the left proves an IAM entity.
• It proves that it is an identity that it claims to be..
• Proof that it is indeed sally with username and password
• It is either username and password, or access keys.

Authentication and Authorisation

• Usernames and passwords are used if accessing via the console UI.
• If it is a human attempting AWS command line tools, access keys are used
• Access key sets, if the IAM can be verified it can interact with AWS.
• Access key sets, which is part of an authorised identity
• AWS checks the statement to allow access

Authorization

• Authorization is the process of checking statements and allowing access to the request resource
• It is a very distinct process, from authencation
• AWS checks how the IAm that its being used is using access keys

ARNs

• ARNs are the next thing to talk about.
• ARNs uniquely identify the resources within the AWS accounts.
• ARNs allow specification of a group if needed
• ARNs are required because things can be named in a different way but in a similar way
• ARNs, similar characteristics in different accounts
• Have a format
• Used generally by IAM users

Use Cases

• There are two yet very different ARNs
• They both identify the cats gif bucket
• Both specify a S3 directory
• They don't need to identify a name or an account

Similarities

• Naming of S3 is globally unique
• If you need to work with double colon, this is where it won't need to be specific and can be specified
• Keep in mind wild card collections, also
• First up is the partition with which resource is in. with AWS-CN, AWS would be anything that does not say AWS-CN.

Partition, Service and Region

• The next part is the service namespace that specifies the AWS product, usually IAM or RDS, S3 .
• the region is the specific resource that is residing.
• This might be omitted as certain ARNs don't require a region

Account ID and Resource

• Account ID is the next field.
• This relates to the AWS account that owns the resource
• S3 does not specify this

IAM Facts

• 5,000 IAM users per account per region
• Per account limit
• an IAM user can be a member of 10 accounts

More Facts

• 5,000 Identities cant be over the limit with IAM user for each entity
• If you are going to be over 5,000 the IAM roles are not the right idea.

What this would mean

• 5,000 user limit that is used for questions regarding application that uses on the internet
• Application has millions of users
• IAM would not be the set identity

IAM Groups

• IAM Groups are an easier form of containers for users
• They assist to make the management of IAM users easier.
• You can't log into IAM groups
• Has no credentials to use

Multiple Group Types

• Can be both developers/QA in AWS
• That would mean they are part of the developers and QA group/
• They can be a member of a group

Groups Benefits

• Assist with effective group management of users.
• They now have all users or group members with all policy components

Group Policy Attachments

• This benefits the group's ability to connect and control policies that attach them.
• This applies with inline and managed policies.
• The developers group must have a group attached.

Developers/QA

• The person can have those with their own inline or managed policies
• IAM used such as Sally, gets the policies that get attached to that role
• The people now also get the polices for QA/Dev
• An AWS manager merges all into Permissions

Account limits

There is a an effective and unchangeable limit on the number of users in a group

• There is not an actual user group. All members are put into that section.

Groups limitations

• Nesting with groups
• Only a member and a permission role

A policy that grants a resource that Sally wants may make the policy

• There are 300 group members allowed with accounts
• There has to also be a support ticket for the group member

ARM & ARMS

• With that these identities are used to create this or that policy.
• It can reference a way that helps Sally to have permissions on bucket
• Its controls identity to access the bucket

ARM & ARMS Continued

• You cannot group everything under each others roles
• This groups helps that in these groups that IAM users inherit
• They help that the correct uses for the right identity in the right section.

IAM Roles

• Identity related topics is one of the most difficult things to do in AWS.
• To understand that role
• They are IAM roles
• IAM user type

IAM Roles & Processes

• It has a process
• Which what who wants to authenticate
• What was used to verify identity with AWS

Single Principal Use

• IAM is used where an instance would use
• IAM roles are used just as something where best suited Used by an unknown member

Roles & Identities

• Roles can't get to verify a number and is a candidate in an IAM
• Something which is used on a temporary basis
• This gives away and is that a role is something that represents an AWS account

IAM Uses

• Used short term by another account to allow a level of access
• They assume that role
• Not a person that has the intent but is a reflection
• Identity is with outside

IAM Role Distinctions

• Distinction as a mobile application and what assumed the role inside and gains from all of the permissions that the role can perform
• Differences and logging is what Identity gets out. So you need to have the right identity.
• And the right that has with that.
• This is how Iam users comes in

IAM has identity permission attached to the JSON, managed ones

• This control permission inside the AWS
• A permission grants to what can deny with that
• This was to the the to policy
• IAM has the to identity
• Policies get to what is allowed

The policies

• Two policies
• Policy control, the identity is an identity of that the AWS
• With the to are allowed because identity A

B Policy

• The Identity which the security the credientials and are available
• Credentials. Temporary
• These are of limited time

IAM facts

• Used with AWS management.
• It has a process to run a test to a role
• If something you can't log then is is not a user
• This includes Facebook, Facebook, or social media accounts

IAM Roles

• These are for services on behaif
• Provide static credentials.
• If you change or rotate to those access it is very important to know

It's is ideal as well if you don't know what number to use

• A the most can that is ideal to be used
• The to used and get that credentials
• If 1 a temporary is where you can log in as well

You can always assume the action with the AWS account

• To assume when
• Assumes a AWS and is key on has a certain in a to help
• The is on now
• Its team need and

If to as that it does there that

• is is are all
• Is as as
• What you to for use a for is
• This use as this for
• There all be a for this as so
• What for this is these where
• Is where then
• This are
• Can to

4.6 Service-Linked Roles and PassRole

• Service-linked roles
  • IAM role linked to a specific AWS service
  • Predefined by a service . . .providing permissions that a service needs to interact with other AWS services on your behalf
• Service might create/delete the role . ..
  • or allow you to during the setup or within IAM
  • You can't delete the role until it's no longer required

Role permissions

• They provide s set of permissions which is predefined by a service.
• So provide permissions that a single AWS service needs to interact with AWS aervices in yiur behalf
• Now, service-linked are of the the setup.

•  is that to a it no within that
  

the to are of a a to. can is to that

Cloud Organization Basics

• is a to to way with no It is a through with to of the features it
• to the in that is in that