Hear you and welcome back now into this video, we will be discussing about this service role and boss
features in AM.
No.
In fact, many of the services extensively makes use of service all and in the long term of your E.W.
is projects.
You will be using service roll as well as possible at some stage.
So let's go ahead and understand it in more detail.
Now the first concept is related to this service at a high level overview.
A service rule is a rule that any service assumes to perform actions on your behalf.
Now, let's assume that you have a cloud for automation and cloud formation wants to create certain
resources like S3 and easy to know what cloud formation can do.
Cloud formation can be associated with a specific service or so.
Service role is very similar to Android, and it has a certain set of policies.
So depending upon the policy that are part of the service rule, if cloud formation is assuming this
role, cloud formation will be able to perform the actions that are defined and allowed within that
specific service.
Or if a cloud formation does not make use of a service rule, then the user who is invoking the cloud
formation, the user splitting mission will be used.
So let's do one thing before we proceed further understand things in more detail.
Let's try it out now for today's demo.
I have a file call is aimed at Yemen, and this is a very simple file.
Only does it create IEM Group calls Demo Group now current game in the cloud formation console?
Let's go ahead and quickly create a new stack.
Let's upload at AMD or M.F.A., so will use this file.
Let's do a next.
Let's call it as demo.
IBM Stack will go ahead and do it next.
Now, at this stage, you have an option of permission, so you can specify the IBM role name or the
IBM role area of the service role that the cloud formation can use.
So if you want cloud formation, use user specific service role, then you have to specify the role,
name order yet.
And if you do not specify that, then the cloud formation will make use of your users permission, so
will not be specifying this.
Let's go ahead and do next, and we'll go ahead and accept and create a stack.
All right.
So now we have a status of create complete.
Let's also quickly verify this from the IBM console.
Let's go to groups and we have a demo group that is available.
Great.
So this first part is easy to understand.
So now let's do one thing.
Let's go ahead and quickly delete our stack.
So as part of the second step, what we do will go ahead and create a service rule and will tell cloud
formation to make use of this service.
Right now within the AM console, let's go to roles.
Let's create a new rule.
Another service that you will be associating with this rule will be cloud formation.
Let's do and next will not give any permission as off now and within their own limits.
Specify Cloud Formation Service rule once, then let's go ahead and create or both.
So the rule is created and let's verify cloud formation.
And yes, our stack is deleted.
So now let's do one thing.
Let's create one more stack.
This thing will be using this team.
I am not Yemen.
Let's do a next.
Let's call it as cloud formation service roll stack.
Let's do a next.
This thing will be specifying the IAM role of cloud formation service rule.
Let's do a next.
And let's create a stack.
Now this that creation should ideally fail, because these service rule that we have created does not
really have any permissions, so if will open up the cloud formation service rule.
You see, it does not really have any permission, so since cloud formation is assuming this role and
since the role does not have any permission, the worlds that creation should feel as expected.
And yet you see this theme.
It is stating that the cloud formation service role is not authorized to perform the IEM operation.
Great.
So let's quickly, Gordon, delete this tech.
Great.
So I hope with this demo you understood on how cloud formation can make use of a service role to perform
certain operations.
The next thing that we'll be discussing is the Basiru know a high level overview bias rule allows the
service to assume the role and perform the actions on your behalf.
Now, for example, you have a IAM, use it and you have a cloud formation.
No, I am use Airtel's cloud formation that you have to make use of.
The service roll call is X now.
Cloud formation will immediately give up permission, denied the message.
If the IBM user does not have the permission to tell cloud formation that it should use the service
rulings.
So what the IBM user should have, I am user needs to have a permission of boss rule so that it can
build the services that it needs to use a specific service.
This is a very important part to remember.
Now to demonstrate this, I have a I am user named as Bob and this am user has is three full access,
as well as cloud formation, full access.
So from the user to Bob, let's go ahead and create a cloud formation stack.
Will be uploading at IBM, not YAML file.
Let's do a next.
This dark let's just call it as Bob's tech.
Let's do a next.
So you are getting certain errors primarily because Bob User does not really have much permissions now
within the permissions here.
Let's go ahead and try specifying the airing of the role that was created.
So we have the cloud formation service rule.
Let's copy the service.
Earlier in, let's select the edit will be stated.
Let's do a next.
Will go ahead and create a stack and immediately you'll see we got an error stating that Be-Bop user
is not authorized to perform i.e. pass rule on the resource of cloud formation so easily.
So that basically means that I am using a ball.
If the user wants to tell cloud formation that it needs to use a service Rule X, then the bob user
must have a bias rule permission on this service.
Rolex.
Now, if you look into how the bicycle based policy looks like, so it's a very simple policy.
You have a primary action of AIM pass through it, and in this resource section, you'll have to specify
the service rule, adding Let's try it.
So let's do one.
Let's go to the user board and we'll be giving up by scroll associated with it.
So let's create a new in lane policy and within this resource here, we'll have to specify these service
rules.
And now you can easily get the service load he had from here, or you can go to the rules to get it.
So let's paste the service rule here in.
Yet, let's review the policy and this this qualités bias rule will create a policy.
Great.
So now at this stage, Bob User will be able to successfully tell cloud formation that it should make
use of unserviceable.
Now at this date, the service truly does not really have any permission for IBM, so let's also give
the permission to this rule.
So just for simplicity, will be giving the IBM full access.
And Will attached a policy.
Perfect, so now from the Bob, use it.
Let's go ahead and try to create the stack yet again.
And you see, it is working perfectly well this time now at this stage, do not Daddy Bob User does
not really have a permission of IBM, but this service rule has a permission of IBM full access.
And since this stack is associated with the service rule, the creation should succeed Buffett.
So now you see the create complete is done.
And if you want to quickly verify, you can do that as well.
So in the user group, you have a demo group.
Now do note that I have two separate tabs with two separate users.
So the first one is where we are using the item and use it.
And the second one is where we're using debug user.
So this is the reason why we are able to explore all of these consoles.
Great.
So I hope at this day you understood the concept of what the service rule as well as the possibly now.
One very important point that you need to note is that once the rules associated with the cloud formation
are, the users that have permission to operate on this stack will be able to use this rule even if
they do not have a permission to pass it.
So you have to ensure that the rule grants leads to privilege.
Very important point in security perspective.
So, for example, let's say our cloud formation is already associated with a service run administrator
use it has associated with it.
No, we have two users, Alice and Bob.
Let's assume that the Alice user and the bob user do not really have a partial permission.
But since the cloud formation is already associated with a service role, both of these users who have
the access on the cloud formation service only will be able to perform or delete stack operation, for
example, and the cloud formation with the help of the service roll permission can delete your resources
altogether.
So let's go ahead and try it on now.
To demonstrate this concept, we have Iiim user of Alice, and the only permission that Alice has is
or the cloud formation service only now from the Alice's AM user.
Again, we are into the cloud formation, and from here, let's assume Alice tries to delete the bulbs
stack.
Let's try it out now.
This action should be successful.
Let's verify.
I'll open up the bulb stack here and the status is delete.
Complete.
So if you want to verify you see the demo group is no longer present.
So this is one of the points that you need to be careful, specifically when and where you're associating
a cloud formation with the service at all.
Now do note that if the cloud formation would had not been associated with the service rule and this
would not really have one reason to delete the stack.
Let's also look into it.
So for simplicity, let's do one thing for our bog use it now again, we are going into so many demos
so that there is no confusion that arises.
And this is one of the reasons why we are doing everything practically so from the bob user.
This time, along with the S3 access, the pass rule and the cloud permission access, let's also give
the access for an.
I so I'll give 'em full access to the Bob user.
And from the Bob user, let's go to the cloud formation stack, let's create a stack yet again.
Let's give the same name, let's call it as Bob New Stack.
This thing will not be giving any Android.
Let's go ahead and create everything with the permission of the bob user, it says.
And as expected, the creation is completed.
If you will verify the groups, you have a demo group available now from the Alliss user.
Let's go to Stacks yet again.
Now Alice is seeing the Bob's new stack and Alice decides to delete it.
So let's but I don't.
And if you would if you see you gotta delete Phil, and if you would like to see the events it states
at least use, it is not authorized to put on the delete group operation.
Perfect.
So I hope with this you understood the basics of service rule, the basics of bias rule, as well as
some of the important security considerations here.
Now what I'll be doing after this video, I'll be hiding the bias rule based IEA policy, as well as
the cloud formation template to create the AIM group so that you can also try it out.
So with this will conclude today's video.