Hello, my name is Demetria Crawford and in this lesson, we will review AWS Identity and Access Management. To use AWS services, you must grant your users an applications access to resources in your AWS account. By default, the only user you have when you first open up your AWS account is the root user. And for security reasons, we don't want to do our day-to-day functions using the root user account because this account has full access to everything. So as you run more workloads on AWS, you need robust identity management and permissions in place to ensure that the right people have access to the right resources. There are two capabilities we will focus on with IAM, that is identity management and permission management. There are two types of identities to manage here. We have human identities such as our developers, operators or consumers of your applications. And then there's machine identities such as your application workloads, operational tools, components which require an identity to make a request to other AWS resources. Let's go ahead and take a look at IAM. If you type in IAM in the search bar, the first thing you should see in your list is IAM Manage Access to AWS Resources. Click on IAM. From the IAM dashboard, there are several security tasks that we can take on. First, we can create new users by looking under Access Management on the left-hand side. We can create user groups. We can define roles that we can then assign to machine identities such as other AWS services. We can create policies to define the permissions that these resources should be able to have or not have. We can adjust our account settings from here and we can also pull reports. So key things that we'll definitely take a look at. Number one is account settings. If we click on Account Settings, you'll notice that there are certain policies that we can create such as password policies, security token service, STS that we can manage. We're gonna get in a little bit more detail about password policy and the next sections that are coming up in this course. But to access those, we have to go to account settings. Next, let's take a look at users. So if I wanted to create a new user, I would click on User. I can click on Add User and go through the steps of creating a username. Now each username should be unique within all of AWS. It is not specific to a region. It is global so it has to be unique across all of AWS. From there we can add the actual access key or define a password for the user so let's put in Lab2 as a username. We're gonna create an access key and a password. Now, you can allow the console password to be a custom password that you create or you can have it to be auto-generated for you. Also, you can require that the password be reset. Once the user logs in for the first time, they will have to create a new password. We're gonna uncheck that for now. And then next week, go ahead and define the permissions. We could do that one permission at a time. We could copy permissions from another user. We can attach an existing policy to the user. But the best practice is to create a group, assign the permissions to the group and then assign users that need those similar permissions. So in this case, I already have one group but I could click Admin and any permissions that this group has, the user that I'm creating will have those same permissions. If we click Next, we're not gonna add any tags. We'll hit review and create user. Now we have a new user enclosed that is created that we can now log in with. But the appropriate thing to do as mentioned is to have user groups that are already predefined. So if we click on User Groups to the left, we can create as many groups as we like. Usually you want to define each group based off of a particular role. For example, if you are a developer and you have a group of developers that will all need similar permissions, well what type of permissions would a developer need? We would create a group, give it a name so let's say we call this group developers. From there, we can actually add users to this group if we want. But the most important thing is to identify if we scroll down what permissions or policies do we want to attach to this group. So let's say I want to make sure that this group always has full access to EC2s then I could click or check the box for Amazon EC2 full access. Now if you want to see what those permissions allow if you click the plus sign, you'll be able to to see the JSON version of the permissions and you'll see the action is EC2. What is the effect is allow everything for that resource. Elastic load balancing allow everything. CloudWatch allow everything. And so if you go through, you can actually see what the permissions are and if it doesn't have the permissions you're looking for, you can keep going and find the actual preconfigured set of permissions or you could create your own by clicking on Create Policy. And from there, you would actually go in and identify the service or resource that you want to attach the permissions to by using Visual Editor. Or if you are familiar with JSON, you could write your own permission. Let's close out of this but I'm gonna leave this as EC2 full access and click Create Group and now I have a group for developers. Any user that I add to this group will inherit all of the permissions that are given to a developer. Now, something to keep in mind is that with all sets of permissions, there is something called implicit deny. In other words, if the permission set does not give you permission, you will not have any rights or access to those particular services. So you have to actually grant all permissions that you want your users to have. Now as I mentioned policies, if we click on Policies, you can also see the list from here. You can also create a policy from here. Now identity providers, identity providers are used to manage your user identities outside of AWS. So if you're authenticating or using another service provider such as Facebook, you can use single sign-on using other authenticating providers and here's where you would add the actual provider. Now, something that else that is important to be able to do is to pull the credential report. So if you go down to the bottom under Access Reports, if you want to identify, let's click on Credential Report. You can download this report that shows a list of all your account users and the status of their credentials. It is a best practice to go through to identify what users you actually have and if they're actually being used. So if you have accounts that are created and they've never logged in in a year, then it's a best practice to disable that account because it's not in use. And you don't want accounts out there that aren't necessary. And so you can use the credential report to pull a list of all your accounts users and the status of their credentials. In this lesson, we reviewed AWS Identity Access Management. In the next lesson, we will review multi-factor authentication.
