Let's take a look at the role of IAM in securing AWS resources.
So what is IAM?
Identity and Access Management is a service for securely controlling access
to a whole variety of AWS services.
Specifically, it's an identity management system that stores users, groups,
and secures access through policies.
There's a whole set of policy language that you can look at.
There's -- policies really describe one or more permission
so to give a permission you apply a policy to a resource.
The policy doesn't necessarily mention the IAM user group itself but once you attach
to the user and group, that permission is granted to that user or group.
So policies can be applied to both users and groups which is nice.
And the aggregate of permissions from all
of the different policies is taken into account when I get access.
An IAM user is much like a login for an operating system so this is a --
it's a simple login sort of thing.
It's a string which is a textural name
so there is no other user attributes of this but the name.
But this could be an individual person.
It could be a system.
You could have a system account, if you will, really that's the idea behind it,
is that any user can have their own security credentials whether that's an access key
or password or multi-factor device, things like that.
And so that's how you can access different things as that user.
Groups don't have credentials per se.
There's no user name, there's no password for a group.
And they can't contain other groups.
There's no nesting of that but they provide another way to align access to resources
so I can organize these IAM users into groups and I don't have to provide access
to resources to each individual user.
I can assign it to the group as a whole.
So why would I use this?
There's a variety of use cases.
There might be that fine-grained access control to AWS resources
to tell you exactly how you can access the APIs.
Users initially have no permission so when you're initially in the system,
it's not like you automatically start with all and you start by restricting.
You start with no access and you must be explicitly granted access to services.
You might also use this for things like identity federation.
AWS team recently released some components
to show you how you can do active directory federation through, with an IAS web app,
where I can go out to that, I can log a user in, and then log them into a AWS service or resource
without prompting that user for credentials.
So I can federate identity using that.
At the same time, there is no support for samel (assumed spelling) or oarth (assumed spelling)
or things like that so it's not as mature
yet as a truly cross platform identity management system that has that sort
of common standard API so it's working towards that.
But that's on the way.
It does integrate with a lot of different AWS services so everything
from the database technologies to storage to compute to the cueing,
all of that plays in there pretty nicely.
And it's free to use so you simply pay for the services that actually leverage IAM.
You don't pay specifically for IAM itself.
What's nice is there is no explicit sign-up; you just simply have that available to you
and you can access it through the management console;
you can access it through that command line interface for Java based users;
you can access it through that query API; and you can access it
through the various SDKs including the .NET SDK.
There's a whole lot of capabilities availability via that API.
There's things around adding user identities and organizing users into groups.
That's supported by operations like create user, create group,
add user to group, remove user from group.
You can also manage permission centrally and put in policies and putting in group policies
and things like that through the API.
You can also manage credentials and create access keys, get session tokens
for temporary user accounts, get federated tokens
if you've got a federated user and things like that.
So the API provides all sorts of basic operations to create user accounts
and delete them, and get tokens and things like that.
In the next exercise what I'm going to do is walk
through how you use IAM to secure resources.
We're going to look first at the console.
The second demonstration, we'll look at how I do it from the raw API.
And the third demonstration we'll look at how I do that using the .NET SDK.