And welcome back now into this video we'll be discussing about the AWB security service, also referred
as DSD, now as this is a pretty important and a very interesting service.
And if you're working in the production environment in the U.S., then you're definitely looking at
this directly or indirectly.
So let's go ahead and understand SPSS.
Now, before we speak about this, let's have a quick revision on how it ADM works.
So let's assume that you have an easy two instance and you have a stable bucket and easy to instance,
wants to perform certain operations on these three buckets so it can be a list, operation portability,
etc..
Now, there are two primary ways in which are easy to instant's can perform operations on the S3 bucket.
One is the way of eatables axis keys.
So your hard core, the long term credentials within your AC2 instance, or you can make use of it.
And now most of the organizations they switch to AM as part of the best practice.
So what do you do?
You go ahead and you create Abdool and that, I am told, will have certain policies.
So let's assume that you have a three read-only policy as well as the easy to read only policy and you
connect that.
I roll to the easy two instance.
So was the analyst connected to the easy two instance that you see two instance will be able to perform
the operations as defined in the policies which were attached to the I am now behind the scenes.
This I enrolled attached to the equidistance will provide certain access guedes certain security and
the station token via the metadata to the easy to instant's and that access secret key and the token
is being used by the Seelie all your applications to perform the operations on the Idalis resource.
So let's quickly have a look into it so that the order concept becomes much more clear.
Now, within the console I have you see two instances runnicles, easy to have finances in and this
instance has I roll easy to evanescent.
Now if you look into the Amdo lawyer, this and Will has one policy, which is Amazon is three Read-Only
access.
So connecting to the easy to instant's via access.
If you quickly do a little extra ellis', you will be able to see that everything is working depending
upon the policies that has been attached.
Now the question that comes is how exactly is maintainability able to perform these operations because
it will need to authenticate in order for this operation to work.
So as we know, that I am doing helps here.
However, in the backend I am rule will provide metadata, which basically contains the access key,
secret, key and the token.
So if you quickly do a call on the metadata and currently you see we are referring to the roll call,
it is to have an SSN and if you press and these are the output, not within the output, you have the
access, Gidi, you have the secret query and you have the token.
So these are the backend things which are actually used as part of the authentication related aspects.
So when you have your application, which is running in this instance, it can make use of these three
things in order to authenticate.
So even when say that I am really connected to the C2 instance in debarking, you still have the access
key, secret, key and the token.
However, remember that these things are different from the long term credentials that are typically
generated for the Amusa.
So going back to our slide, the responsibility of generating those temporary credentials, which were
the access key secret gained Tolkan is the responsibility of this secure token service.
So the SD is actually responsible for generating those credentials.
So now let's go ahead and discuss more about testiest now going by the terms of our definition.
Eatables Espers is a Web service that enables you to request temporary, limited, privileged credentials
for the IAM users or for the Federated Users that might be present within the organization.
Now, one important part to remember here is this word temporary.
So you the temporary security clearances are short term and expire after a certain duration.
So whatever credentials that we just saw from the SSA to cancel that credentials are temporary.
And after a certain duration, they will automatically be replaced with the newer credentials.
Now, since they have a limited lifetime, that rotation is no longer explicitly.
Now, generally, whenever you create a great credentials which are at Siskind secretly associated with
the Amusa, many complaints is that after three months, all the users should replace their AmEx's in
security, primarily because the other long term credentials have other credentials which are generated
with the of the short term, which means that maybe after a few hours that intelligence would change.
Now, that's the primary difference between a long term and a short term arrangement.
Now, do remember that these clearances definitely work.
So if you copy these credentials to your laptop and you will be able to perform all the operations which
were associated with the IBM rule.
So let's quickly find that out.
I'm in my Seela in my laptop, so let's go ahead and open the Idalis credentials here.
And you have the default, access and secret.
So these are basically the long term credentials.
So this is something that we are not really looking into right now overlooking is in the short term
credentials.
So let's call this profile as a space.
And first, let's define the eatables access axis will define the eatables secret access key and will
also define the devastation.
So the first thing let's copy this access Kiddi.
The next thing will copy the security.
And the last one, which is the station token.
Let Scoppetta.
And will be here.
So I'll go ahead and say it now, when you quickly do it with history and with the profile of a CDs,
you see you're able to perform the operations.
And this operation is primarily because of this access key, secret key in that organ.
Now, as you are discussing that these are temporary credentials and after some time they will be rotated.
So it also shows you what is the last updated time.
And it also shows you what is the expiration time associated with discrimination's green.
So I hope at a high level or you understood what a spears' does.
So let's look into it in terms of the architectural perspective where you can have the AYAM users,
you can have the filtrated users.
So these are the two examples that we have taken and they can request to the espionage service.
So this MSDS service will generate these temporary security credentials and these credentials will be
given back to the end users.
So let's also look into the possibility of how I am a user can call ask service to generate a temporary
security credentials.
Let's also look into that.
So if you go into the command line reference, you have the SD and there are certain available commands
or you're the one that we are interested here is the gate station KUKAN.
So if you look into the description, the gate station token, it returns a set of temporary credentials
for it.
Amusa so very similar to the architecture, like the very same user will go ahead and request for a
set of temporary credentials and the SD service will return it back.
Now, in this type of architecture, the IAM user will need a long term credential.
So he needs access in secret keys as part of the authentication as well as the authorization related
aspect for SD Green.
So coming back to the CLIA, currently, I have a long term interest in their default profile and these
are associated with the IAM user who has the administrator privilege and we are keeping it simple for
the time being.
So now let's go ahead and run this year.
So I see it as a stop gap decision token.
And if you go down, you can also specify the duration.
What as we are discussing that SPSS generates the temporary security clearances, that means that it
will expire and you can specify the duration of that expiry.
So if you look into this specific option or year, so the minimum time is 15 minutes and the maximum
time is 36 hours that you can define.
So currently all of these are optional parameters.
So if we just run this command, it should give you the credentials here now as expected and very similar
to that of the employer.
You got a secret key.
You got the session token as well as you got the access key.
So these are basically the credentials which were generated by the CDs.
So if you see it also has the expiry associated with it.
So this is the high level architecture.
Now, again, the one that we were discussing right now where the user is using his long term credentials
to generate temporary credentials.
This is generally not used in production environment.
There are other ways like single sign on and samel authentication, which are generally used and used
that is out of school for today's video.
So we are just keeping it simple so that we understand the architectural perspective.
Now, another popular architecture which uses space is basically the cross around access where you have
the rule in account one and that I enroll has a trust relationship with another cross account.
I am role in account to an account, and from this I enroll.
You can go ahead and fetch the credentials associated with the rules in account to an account in a similar
way.
Let's say that you have Amusa in account one and there is a trust relationship between account one and
account two.
So this IAM user will be able to perform the Ausubel operation on the Read-Only or Facundo and the administrator
of the account, and he'll be able to fetch the temporary credentials associated with these rules to
perform certain operations.
Let's have a quick look into these.
So currently in a different browser, I have a new account here.
Let's quickly go ahead and create a cross account rule, so.
Within the country to trust, I specified the account by the account, one within the permission.
Let's quickly give the street he'd only access and let's call it as cross account read-only and we'll
go ahead and create a rule.
So what we have done in the account to we went ahead and we created a read-only rule.
And within the trust relationship, as you know, we had added the account number associated with the
aid of this account.
So from this eyewitness account, we will be able to assume this role and face the temporary credentials
which were assigned to the Read-Only role of the accountant.
So in order to do that, let's open up the case again.
And you have the command of Azuma.
Let's explore this.
So again, it is making use of the estate so you have idealist's assume role and then you have to specify
the rule area and the rules say Sinem.
So these are the only two things which are required.
So let's try it out.
So I see the best ESPs assume role followed by the rule here in no the rule, Aaron, will have to fetch
the rule area.
So this is the rule of the accountant and you'll also have to specify the rules.
Say name, let's call it Espin.
And as expected, again, it has basically given us the secret access, keep the station together and
this access key.
So this credentials that we were discussing here, these are the credentials associated with the Read-Only
Rohloff account, too.
So from these credentials, you will be able to perform the operations on the account.
Now, one of the common architectures that you will see in production environments of lot of enterprises
is not of that of the end user, but that of the Amron.
So you you will have what you see two instance, which will have it abroad.
And if your application within that easy to instance, wants to perform certain operations on account
doora country, then you would create the architecture that we were discussing just now.
So I'll give you one real values case.
So, you know, one of the organizations that I have been working with within the account, one, we
had a specific vulnerability scanner which used to scan the container images from X and all of the container
images were present in account to an account.
However, the vulnerability scanner was present in the account one.
So what we used to do, the easy two instance where the vulnerability scanner was present, it was amazing
and I am told and from there it was able to perform the SD assume role operation on the account to India,
the country and the credentials that it received from the Asurion operation.
It uses their credentials to scan the images from the easier and to also look into the images which
are part of the X cluster.
So that is one common architecture that you will see.
And this is one of the best practice architecture when it comes to the Amarula across accounts.
Now, before we conclude, let me show you an interesting thing, because a lot of users, they say
that we have a Amusa, but that I am a user in order for him to perform the SD operation on the rules
of Idalis account to there is a country.
He will need his long term credentials within his workstation.
So that is not the best way, because if that long term credentials are leaked, then again, we are
back to the point zero.
So what you can do is you can make use of various methods related to single Sinon.
So I'll quickly give you one example here.
So the example goes similar to what we are seeing here where the user will have to first authenticate.
So let's go ahead and authenticate against this thing that Sinon portal will do assigning.
All right.
So from here, he can select which ever Idalis account he wants to perform the operations.
So as we're are discussing, you have a user, he is not an user, but he wants to perform certain Seela
operations on account to an account.
Now, what he'll do, he'll first sign into the single sign on page and then he'll see all the accounts
that he has access to.
In this case, he has access to one of the leaders account.
So he'll click on this account.
Let's quickly open it up.
And there are two options here.
One is the management console and second is the ceiling.
So let's keep concealer.
And you see that the single sign on page automatically it retrieved the set of credentials, which are
the access key, this secret key and the token.
So you see you have to access key.
You have the secret key as well as you have the station token.
So in this approach, the user, without having any long term credentials, he can fit these temporary
credentials and he can use these credentials to perform certain operations on the account.
So, again, this also makes use of space behind the scenes.
Great.
So that's the high level overview about SD.
I hope this brief introduction has given you an overview idea about the importance of the service so
that this will conclude this video.
I hope this video has been informative for you.
And I look forward to see you in the next video.