Heroin.
And welcome back.
Now in today's video will be discussing about the external ID.
Now, external ID is a piece of data that can be passed to the assumed role API of the security token
service.
Now, the overall purpose of the external ID can be explained with this animation that we have now.
On the left hand side, you have an account call example account.
So basically there are three accounts over here that belongs to three different entities altogether.
Now within the example account, you have a cross account roll through which the IAM users of the service
Corp account will be able to log in.
So this is the cross account rule that is present and you also have an attacker account.
So this Service Corp account is providing the service to both the example account as well as the attacker
account.
Now once the cross account rule has been created, the example account administrator will basically
provide the role URL as well as the admin, primarily because in order to assume the role, you either
need a URL or the n.
So once the example account administrators provides these details, the users from the service Corp
account or the application that is running in the Service Corp account will be able to assume the role
and also access the resources depending upon the permission that is been assigned to the role.
Now, the challenge that can occur in such a scenario is that this Service Corp is providing an application
as a service to both the example as well as the attacker account, and if the attacker account provides
the role URL and the end of that of the example account role, then what will happen is that the application
or a service that is running in the service corp account will use this URL or then to assume the role
and access the service.
So essentially what will happen is the attacker account.
If he's able to guess the end of this specific role, he can specify it to the application which has
been provided by the Service Corp account to access the resource of the example account.
So this is the overall challenge that is being faced by a lot of organizations.
And in order to overcome this, we make use of an external ID, So external ID is an additional piece
of data that you provide besides the role they are in in order to assume the role.
So that's the high level overview about the need of external ID.
So let's do one thing.
Let's quickly have a demo so that this can be better understood.
So within the eight service account, there are two role that is being created.
One is a normal role and second is the role which uses external ID.
Now both of them are a cross account role and if you look into the trusted entity, this is the account
number of a trusted entity.
So first, let's do one thing.
Let's go to the normal role over here.
And if you look into the trust relationship, if I quickly edit it, it is basically allowing a principal
from this specific account number.
Now from a different browser, I am already logged in via a demo user to that account which has been
trusted.
So we'll be trying and assuming the role for both where external ID is required and external ID is not
required.
And this thing will be assuming the role based on both the URL as well as the admin.
So first, let's do one thing.
Let's do it.
We the URL.
So I'll copy the URL and from the browser as soon as I put it within the URL bar.
Let's click on Switch role and as expected, we are successfully logged into the account.
So let's quickly go back.
Great.
So that's the URL.
Now let's quickly try it via the CLI also.
So from the CLA, I already have a command ready.
So what we are doing, we are doing a e star is a zoom role.
We are providing the role that does not require the external ID and you have a role session name.
So basically for this ClA, I have the access and secret key associated with the demo user which I already
configured.
So as soon as I press enter over here, you should see that you have a secret access key, the session
token as well as the access ID that I generated.
So for this specific role, both the GI as well as the CLA access are working as expected.
So let's go back to the roles and let's go a bit down this time.
Let's open up the role call external ID.
Now if you look into the trust relationship, now the overall trust relationship remains to be similar
to that of the previous role.
However, there is one additional condition that is specified over here, and the condition is when
a string equals SDS, external ID, which is 090295.
So that basically means that anyone who wants to assume the role should provide this specific external
ID, without which the role assumption will not work.
So let's try it out.
Now, before we go ahead and do that, if we look into the documentation associated with the assumed
role, let's go a bit down.
So here there is a specific option where you can specify external ID and this is something that we will
require.
So first, let's go ahead and try to assume this role without giving any external ID.
So I'll clear the screen.
Let's go ahead and replace the admin.
Now, as soon as you press enter, you see, you immediately got an error over here.
Now, let's do one thing.
Let's try to specify the external ID.
The dis 090295.
Now, as soon as you add the external ID, you see things are working as expected.
All right.
So I hope you understood why external ID is required.
Now, in such cases, even if an attacker account enters your role within the application which is provided
by the Service Corp account, the Service Corp account will not be able to assume the role since the
external ID is not provided.
Now, one very important part to remember is that external ID will only work when you are assuming the
role via the CLA or SDHC.
It will not work if you are doing it through the browser.
Let me quickly show you this so I'll copy this URL and let me quickly enter it here.
So let's try to switch the role.
And you see you got an error saying that invalid information in one or more fields.
So that's the error that you will typically get for the role that requires external ID.
Now, before we conclude, let me show you on how you can create a role with external ID.
So the overall steps are very similar.
So let's do one thing.
Let's go ahead and create a role with another account within the account ID.
You can specify the account idea of a destination account and all you have to do is you have to select
the first option, which requires the external ID or you're within the bracket.
You see, it is a best practice when a third party will assume this role.
So this is very similar to the challenge diagram that we are discussing, where the importance of external
ID comes into picture primarily when you are using a third party service.
So once you select this option, what you have to do is you will have to specify the external ID.
So depending upon what you intend to do, you can just specify the external ID over here and once then
you can go to next.
Let's avoid the policy for now.
And let's just call it a C hyphen temp.
So from the console, if you quickly look into this role and if you look into the trust relationship
or you should see that you have a trust relationship with a specific condition where the string equals
the external ID that you have provided.
Great.
So before we conclude, let's quickly revise the two important pointers here.
First is that once the external ID is set, when someone uses the CLI or API to assume the role, they
must provide an external ID.
Second is you cannot switch roles at the console to a role that is an external ID condition within the
trust policy, so console cannot be used.
You have to make use of options like CLI, SDK and so on.
So that's the high level overview about the external ID.
I hope this video has been informative for you and I look forward to see you in the next video.