Welcome back to Backspace Academy. In this lecture we'll have a look at the 2
security identity and compliance services of AWS. Now this is a very 3
important category of AWS and as such there is a very broad selection of 4
products that are available once we've done that we'll finish up with a 5
hands-on lab using the Identity and Access Management Service 6
AWS artifact is an online portal that provides access to AWS security and compliance 7
documentation and that documentation can be readily available when needed for 8
auditing and compliance purposes AWS certificate manager issues ssl 9
certificates for HTTPS communication with your website it integrates with AWS 10
services such as route 53 and cloudfront and the certificates that are 11
provisioned through AWS certificate manager are completely free 12
Amazon Cloud directory is a cloud-based directory service that can have hierarchies of 13
data in multiple dimensions unlike conventional LDAP based directory 14
services that can only have a single hierarchy AWS directory service is a 15
fully managed Microsoft Active Directory service in the AWS cloud AWS cloud HSM 16
is a dedicated hardware security module in the AWS cloud this allows you to 17
achieve corporate and regulatory compliance while at the same time 18
greatly reducing your costs over using your own HSM in your own infrastructure 19
Amazon Cognito provides sign in and sign up capability for your web and mobile 20
applications you can also integrate that signup process with external orth 21
providers such as Google and Facebook and also SAML 2 providers as well 22
AWS identity and access management or IAM for short 23
allows you to manage user access to your AWS services and resources in your 24
account, users and groups of users have 25
individual permissions that allow or deny access to your resources 26
AWS Organizations provides policy based management for multiple AWS accounts 27
this is great for large organizations that have multiple accounts and they 28
want to manage those and the users that use those accounts centrally Amazon 29
inspector is an automated security assessment service it can help to 30
identify vulnerabilities or areas of improvement within your AWS account 31
AWS key management service or kms for short makes it easy to create and control 32
encryption keys for your encrypted data and it also uses hardware security 33
modules to secure your keys it's integrated well with AWS services such 34
as Amazon s3 redshift and EBS. AWS shield provides protection against distributed 35
denial of service or DDoS for short protection against DDoS attacks the 36
standard version of a double shield is implemented automatically on all AWS accounts 37
Web Application Firewall or where for short is a Web Application 38
Firewall that sits in front of your website to provide additional protection 39
against common attacks such as SQL injection and cross-site scripting it 40
has different sets of rules that can be used for different applications 41
now let's have a look at using one of the core AWS security services Identity 42
and Access Management or I am now up until now we've been logging into our 43
account using the email address and password that we use to create that 44
account and that is logging in as a root user and it is not desirable to do that 45
the reason I say that is that the root user will have access to everything 46
access to finances, credit card access to locking people out of that account and 47
so that is something that cannot be compromised otherwise you're in a lot of 48
trouble so what we do is that we lock that down we put a very long password 49
and complicated password on that account and we can also have multi-factor 50
authentication if we want to go to that next step of locking that down 51
once we've locked down our root access we can create an I AM user and we can log in as 52
that I am user and that I am user will have permissions specific for what we 53
need to do and so if we for whatever reason need root access we can still get 54
that if we need to but we login for the most part as an IAM user and that 55
protects our account so again we go to services and we look for the I Am 56
service now once we're in there we can go to users on the left here and we can 57
create a user by clicking on add user will give that user a name I'm just 58
going to call it test that'll be fine now that user can have management 59
console access yes we would like that but they can also have programmatic 60
access if they're going to be connecting into a software development kit or 61
connecting in through the command line interface remotely so we're going to 62
give both of those and it's because it's going to be ourselves that'll be 63
assuming this user we can put in a custom password there 64
so I've just put in a password that I'll remember and we won't worry about 65
changing that password because it's for us not for someone else so once we've 66
done that then we can attach permissions to that user so we click on next 67
permissions up the top here we've got attach existing policies directly so AWS 68
have already done the work of writing policies specifically for job functions 69
so if we click on that and what we can do is we can select your administrator 70
access and that provides full access to AWS services and resources but that does 71
not include financial and that sort of secure account management stuff so we 72
can attach that policy to this user that we've created so we click on review and 73
we can see there we've got a user named test and they've got both programmatic 74
access and management console access and their permissions are defined in their 75
administrator access so basically gives you full access to use all of the 76
resources or all of the services we click on create user so that user has 77
now been created and we can see here we've got an access key and a secret 78
access key and we can download all of this information so if we download that 79
now and we can say that somewhere and that's our credentials so when we open 80
it up that file it will have information about how we log in to the management 81
console so before we would have been logging in from aws.amazon.com but now 82
we've got our own sign-in link and yours will be different and if we click on 83
that now we will be able to sign in as at IAM user so you will have your 84
account ID or if you've created an alias it will be an alias now I've created an 85
alias from my account called backspace - labs but you will no doubt just had your 86
account ID there put in the name of that user that we created 87
and then we put in the password that we created for that user as well and if we 88
sign in now we should be able to get in and so there you go where we've signed 89
in back to where we were in the AWS management console so now we don't need 90
to use those root user credentials so what we can do now is we can change 91
those root user credentials so to do that we need to log in as the root user 92
so we go to our account up here so I'm logged in as test so I want to sign out 93
and then log in with root access so I click on sign out and that'll take me 94
back to the AWS home page so if I go back into my account AWS management 95
console and I get this screen that we had before down the bottom here is a 96
link sign-in using root account credential so I'm going to click on that 97
and that's going to get me into and my root user so I just climb in and there 98
we go we're signed in now as the root user of the account so what we can do 99
now is do the same thing again we go into our account details here but we go 100
down to my security credentials and what we can do now is that it's going to give 101
us a warning that we're going to be changing the security credentials of the 102
entire account so that is what we want to do so we're going to continue to 103
security credentials and here we can see up the top here is password and click 104
here to change the password name or email address of your root access 105
account so we click on that and here we can go so we can update that password so 106
we click on edit and we can put our current password in and then our new 107
password which I'm not going to change because I don't want to change it but 108
I'd advise you to do that and put in a really really long and complicated 109
password use a password generator to do that and that will help to secure down 110
your AWS account you can also enable multi-factor authentication it's a 111
little bit a long-winded process but that will give 112
you a little bit more security as well if you want to go down that process so 113
for now I don't want to stay in the root user so I'm going to log out and next 114
time I log in I'll use my IAM user. So that's all I need to show you now on 115
creating a IAM user going through the course we're going to learn a lot more 116
about IAM and you'd be going on to do an associate level certification you'll 117
you'll be an absolute wizard this by the end of it you'll be creating policies 118
you'll be doing a lot more with this so I look forward to seeing you in the next 119
lecture