All right we'll come back.
So let's talk now about users what is an AM user.
There are two types of identities in AM.
One is the user.
So I like myself like the account and the you are the developer or the architect.
This is an I am a user.
A person who can type in an easy name and password.
But think about it.
There could be an application within that needs to talk to you or I can try to how can you authenticate
What's the indication when you enter a username and password or an AIM user and password that you are
being authenticated and the next step if you are authenticated successfully is you're going to be checked
and authorized if you can do that or not.
So let's say I want to log in to my account so it will authenticate me.
Again it's the account credentials that are available for them users enter my username and password
and I'm allowed in.
Now I tried to create an easy to instance but I cannot.
When you try to do an action then you have to be authorized first.
So authentication is one thing.
Authorization is a different thing.
So authentication are you allowed into the account or no.
Yes I am allowed.
Then comes the credentials the permissions that you have and any user that you create initially has
no permissions whatsoever.
So he's denied from anything so you create the user create the password maybe the keys.
And then you start thinking about the permissions.
OK.
So that's the user.
So if my an application on an easy to instance in my account would like to reach to SSD to store an
object or fly it or download a file then that application needs permission as well.
In your account and in the cloud generally speaking if security is not tight and at the same time is
not an inhibitor from doing the job on the functions then that cloud is not the right one.
It has to be secure and you would have to be able to authenticate and authorize every single user application
or action in your environment.
So the I AM role and will see in the I AM section later on we will have a deep dive into I am roles
and I am users and identities and all that.
But the I AM role is that you can think about it as a virtual user or user that doesn't have hands to
type on a keyboard and legs to walk.
So that would be an application that you have or as you'll see later on a container micro service that
you have in your environment that you need to provide the temporary credentials for which we are called
the I.M. role.
So it can reach out to other services and E.W. as Store Services can go to the database and read from
it can go to a dynamo D-B that is stable and read or write to it.
So if it is an actual user then that's an actual user or an application that needs permanent credentials.
Then you have to create I am users if it is an application that only requires temporary access in order
to write something or read something or store something then you create rules.
OK but I am a user can I use the rules.
Yes you can use I am rules and we'll go through the circumstances.
Why would that happen.
Why would you need that.
So I'm use or using my my phone not myself I'm using my phone and I would like to connect to a specific
service through my phone.
So the application through the game then I am wrong is the way to go.
I am has a limit of the number of users that you can create in an account 5000 number that I last checked
was 5000.
What if my company has 10000 20000 40000 employees.
What do I do with the others.
Then you will have to go to roles.
And what you call the secure token service temporary credentials when you want to access something you
would be given temperature adventures that expire after some time.
OK.
So remember that the I am users are permanent credentials not permanent.
I mean it's a long term long lived credentials and their roles are short lived credentials.
How about groups if you have a number of users let's say developers and I would like instead of defining
permission on I want one by one base I want to define permissions based on a group of developers so
these developers can get to that environment which is their development environment for the new application
we are building now.
So why don't I just group them in one group and assign permissions to the group.
So it's a logical grouping of users which makes the administration assigning permission to revoking
permissions adding deleting changing and all that different.
OK.
Now I am Isa I have I'm an I am user and I have permissions.
Can I be joined into a group.
Yes you can.
So can you can I join an existing user intergroup.
Yes you can.
Can I remove a user from a group out.
Yes they user in the group can he or she have the group permissions plus other permissions.
Yes they can as well.
OK.
So let's go ahead and create our users which will be our third take here.
So click on users and here as you can see they are coming because it's a new account.
I don't have any users so let's add a user.
So what you want to call the user.
I'll call it Donald Duck.
OK.
So that's the name of the user select access type.
There are two access types for item users.
One is the console access username and password.
What if I have it's DKs and I would like to communicate with AWOS and start using the Linux Yes Linux
command line interface.
What I want to communicate with application programming interface is to do things without logging to
the console.
You can with commands and you can address API.
You can do a lot of common things either way in any one of these access methods.
OK.
So programmatic access is anything other than the console.
So you want to deal with a command line interface you have is the KZN to authenticate then you will
have what we call access key ID and secret access key to that peer the access key ID and the secret
Esky are called access keys and these are used if you want to access it.
Yes through AP eyes command line interface or is DKs or development tools so it's not hand it's not
a username and password to get to the console.
And what we are here on now is called It will be a sequence.
The other one is the areas management console access and this is when when you have a username you define
a password and optionally if it is a VIP or a privileged user it recommends enabling a for them as well.
The multi-factor authentication for them as well.
All right so which one should I configure depends on the user if the user is going to a developer that
will never log on to the console.
Everything will be done so as the case why do I need to configure for them console access.
They don't need it.
So if they use needs programmatic access configure for them only the keys if they need constant access
configure for them the console.
But if they don't need Program Access then just define the console.
If they don't need the console and just the programmatic access then define that.
So least privilege access is and I and I am best practices that it defined give the minimum set of admissions
or privileges for a user to do his or her job.
Nothing more than that.
Why not more.
Maybe in the future they would need this or that when they need it you can do it.
And that's why we have the groups you can combine them into groups and you can assign rules and permissions
to the groups.
OK.
So let's say for this one I'm going to define both of them.
So the generated password the custom password didn't do a custom password.
You can opt to choose the password if you want to.
Now if I type you will you will be able to see it or just hide it and it will be hashed then when the
user logs in user must create a new password at the next signing.
You can force them to change the password.
And this is a best practice as well.
And users if you take that one.
So default is require a password reset.
So it is a must create a new password next time and use automatically gets the user changed password
policy to allow them to change their own password.
To backtrack that because that's a potential exam question.
You have created the username What is the immediate next step.
You change the access type programmatic or concer password if you're going with a password then the
next one is you need to configure the password.
And then you need to force them to reset or you can check it out if you don't want that and then permissions.
So before going to the permissions you define the password or the access keys.
Right.
OK you can and they use that I'm creating now.
So now I'm a step number two permissions I can add it to an existing group if any I can copy permissions
from an existing user.
So instead of going and doing policies and all that this user is a developer and I have another one
that is developer I'm just going to copy permissions from to attach existing policies directly.
So these are the three options that we have here.
So let's work it here.
Let's take a break and come back and continue on with the group creation and the different options we
have on the screen.
I'll see you after the break.
Thank you.