AWS Identity Access Management (IAM) Practical Applications

This lesson covers the fundamentals of IAM User with following topics

• Root User

• Create new IAM User

• Account alias

• Login to AWS Management Console

This lecture covers common type of users in the real world to set the context for rest of the course.

1. Principal

2. Credential

3. Root User

4. IAM User

5. Federated Users

6. External Users

7. Workload User

This lecture covers access & secret access key and how they can be used to access S3 resources using Access Key with AWS Command Line Interface (CLI) and Access Key with AWS Software Development Kit (SDK)

• Create Access Key

• Access Key management

• S3 bucket and object setup

• AWS Command Line Interface (CLI) to access S3

• Long-term key risks

• AWS CLoudShell

This lesson covers IAM Group and how to add users to a group. 

• Create IAM Groups

• Adding IAM Users to IAM Group

• IAM Group permission

• IAM Group use cases

This lesson explains the basic concept of an AWS Policy. 

• Policy in the real world

• AWS Policy

• Permission

• AWS policy types - Customer managed vs. AWS managed

This lesson covers the basic structure of an IAM policy and elements that will be covered in this course.

• Create policy

• Version

• Statement

• Statement elements - SEPARC

  • Sid

  • Effect

  • Principal

  • Action

  • Resource

  • Condition

This lesson covers Statement ID - Sid and its purpose in the IAM Policy

• Sid purpose

• Unique Sid value rule

• Case sensitive Sid value

This lesson covers statement element Effect and how it works in the IAM Policy

• Allow vs. Deny

• Implicit default

• Access S3 resource using AWS CLI with policy

• Multiple statement with Allow and Deny

This lecture covers statement element Action and how it works in the IAM Policy.

• Action purpose

• Available actions for AWS Service

• S3 action examples

• Wildcard character

This lecture covers statement element Resource and how it works in the IAM Policy

• Resource in AWS

• Amazon Resource Name (ARN) convention

• Case Sensitive rule for resource name

• Wildcard characters

• Single character "?"

• Action - Resource Mapping

This lecture covers statement element Condition and how it works in the IAM policy.

• Condition element structure

• Condition operator

• Global and Service Condition keys

• Condition to Action mapping

• Tag based policy use case

This lecture covers variables and how it works in the IAM policy

• Variable use cases

• S3 personal folder demo

• Resource variable rules

• Condition variable rules

• Tag-based authorization demo

• Default value

This lecture covers statement element Principal and how it works in the IAM policy

• Using IAM User ARN as principal

• User-based policy vs. Resource-based policy

• S3 bucket policy demo

• Principal element rules

This lecture summarizes the main topics covered in IAM Policy and tips.

• Mutually exclusive elements

• Wildcard character warning

• IAM Access Analyzer

• IAM Policy Editor

This lecture introduces the main concept of IAM Role

• How IAM Roles work

• Create IAM Role

• Trust policy

• Assume role demo

• Short-term credential

This lecture deep dive into cross account use case using IAM Role. 

• Cross account trust policy

• IAM user policy to assume role

• Assume role demo

This lecture compares difference between accessing resources across AWS accounts using resource-based policy versus IAM Role. 

• Scope

• Permission required

• Identity-based permission

• Cross partition

This lecture demonstrates using IAM Role in the EC2 Instance Profile.  This is common pattern in AWS where a service assumes a role and access resources. 

• EC2 Instance Profile feature

• Create Role for EC2

• Launch EC2 and test role permission

• EC2 temporary credential

• Service-linked roles

This lecture covers the core concept of IAM Permission Boundaries.

• What is permission boundaries?

• Effect of permission boundaries on IAM policy

• Delegate use case

This lecture covers the core concepts of IAM Session Policy.

• What is session policy

• Effect of session policy on IAM policy

• Session policy demo

• Identity broker use case

This lecture covers the difference between control plane and data plane. 

• Control plane operation & region

• Data plane operation

• Auth Runtime Service (ARS)

This lecture covers the AWS Organizations service.

• Organization Unit

• Management account

• Consolidated billing

• Provisioning accounts

• Organization policies

  • Service Control Policy (SCP) demo

• Organization structure

This lecture covers AWS IAM Identity Center service

• Human users at scale

• Single-sign on

• Identity center directory

• Permission sets

This lesson covers identity federation use case using Azure Entra ID as identity provider and IAM Identity Center.

• Identity federation use case

• SAML

• SCIM

• Attribute-based Access Control (ABAC)

This lesson covers several solutions to help you log and audit activities in IAM to stay secure and compliant.

• Built-in features in IAM

• AWS CloudTrail

• Amazon CloudWatch

• AWS Config

This lesson covers how various policies work together and AWS evaluates them to determine either allow or deny requests.

• Request Context

• 3 main rules

• Evaluation logics

• Helper tools

This lesson covers best practices for IAM as you continue your cloud journey

• Growing pains

• Security best practices

• Root user

• Least-privilege permission

• Policy types solution

• Long-term keys

• Quotas

• Well-Architected Framework