Advanced Identity

 Advanced Identity

AWS STS (Security Token Service)

  • Enables you to create temporary, limited privileges credentials to access your AWS resources
  • Short-term credentials: you configure expiration period
  • Use Cases:
    • Identify federation: manage user identities in external systems, and provide them with STS tokens to access AWS resources
    • IAM Roles for cross/same account access
    • IAM Roles for Amazon EC2: provide temporary credentials for EC2 instances to access AWS resources

Cognito

  • Identity for your Web and Mobile applications users (potentially millions)
  • Instead of creating them an IAM user, you create a user in Cognito

What is Microsoft Active Directory (AD) ?

  • Found on any Windows Server with AD Domain Services
  • Database of objects: User Accounts, Computers, Printers, File Shares, Security Groups
  • Centralized security management, create account assign permissions

AWS Directory Services

  • AWS Managed Microsoft AD
    • Create your own AD in AWS, manage users locally, supports MFA
    • Establish "trust" connections with your on-promise AD
  • AD Connector
    • Directory Gateway (proxy) to redirect to on-premise AD, supports MFA
    • Users are managed on the on-premise AD
  • Simple AD
    • AD-compatible managed directory on AWS
    • Cannot be joined with on-premise AD

AWS IAM Identity Center (Successor to AWS Single Sign-On)

  • One login (single sign-on) for all your
    • AWS accounts in AWS Organizations
    • Business cloud applications (e.g. Salesforce, Box, Microsoft 365...)
    • SAML2.0-enabled applications
    • EC2 Windows Instances
  • Identity providers
    • Built-in identity store in IAM Identity Center
    • 3rd party: Active Directory (AD), OneLogin, Okta....

Summary

  • IAM:
    • Identity and Access Management inside your AWS account
    • For users that you trust and belong to your company
  • Organizations: Manage multiple accounts
  • Security Token Service (STS): temporary, limited-privileges credentials to access AWS resources
  • Cognito: create a database of users for your mobile & web applictions
  • Directory Services: integrate Microsoft Active Directory in AWS
  • IAM Identity Center: one login for multiple AWS accounts & applications

Comments

Post a Comment

Popular posts from this blog

Machine Learning

Image
 Machine Learning Amazon Rekognition Find objects, people, text, scenes in images and videos using ML Facial analysis and facial search to do user verification, people counting Create a database of "familiar faces" or compare against celebrities Use cases: Labeling Content Moderation Text Detection Face Detection and Analysis (gender, age ranges, emotions...) Face Search and Verification Celebrity Recognition Pathing (ex: for sports game analysis) Amazon Transcribe Automatically convert speech to text Uses a deep learning process called automatic speech recognition (ASR) to convert speech to text quickly and accurately Automatically remove Personally Identifiable Information (PII) using Redaction Supports Automatic Language Identification for multi-lingual audio Use cases: transcribe customer service calls automate closed captioning and subtitling generate metadata for medis assets to create a fully searchable archive Amazon Polly Turn text into lifelike speech using deep lea...
Read more

Cloud Computing and IT

Image
Cloud Computing and IT How Website work?   Server composed of: Compute, memory, storage(file or database), network - Routers, switch, DNS server. IT terminology: Network: cables, routers and servers connected with each other. Router: A networking device that forwards data packets between computer networks. They know where to send your packets on the internet. Switch: takes a packet and send it to the correct server/client on your network. Problems: Pay rent for datacenter Pay for power, cooling and maintenance Adding and replacing hardware takes time Scaling is limited Hire 24/7 team to monitor the infrastructure Plan for taking care of disasters. eg: Earth-Quake, Power-Supply issue etc... Demand: How to externalize all above task? Solution: Cloud Cloud Computing: (on-demand/pay-as-you-go/) Cloud computing is the on-demand delivery of compute power, database storage, applications and other IT resources. Cloud services are pay-as-you-go pricing. Provision exactly the right type and ...
Read more

Cloud Monitoring

Image
 Cloud Monitoring Amazon CloudWatch Metrics CloudWatch provides metrics for every services in AWS Metric is a variable to monitor ( CPUUtilization, Networking...) Metrics have timestamps Can create CloudWatch dashboards of metrics Important Metrics EC2 instances: CPU Utilization, Status Checks, Network (not RAM) Default metrics every 5 minutes Option for Detailed Monitoring ($$$): metrics every 1 minute EBS volumes: Disk Read/Writes S3 buckets: BucketSizeBytes, NumberOfObjects, AllRequests Billing: Total Estimated Charge (only in us-east-1) Service Limits: how many you've been using a service API Custom mertics: push your own metrics Amazon CloudWatch Alarms Alarms are used to trigger notifications for any metric Alarms actions Auto Scaling: increase or decrease EC2 instances "desired" count EC2 Actions: stop, terminate, reboot or recover an EC2 instance SNS notifications: send a notification into an SNS topic Various options (sampling, %, max, min, etc...) Can choose the...
Read more