1
00:00:00,500 --> 00:00:03,280
Okay, so let's play with IAM policies.

2
00:00:03,280 --> 00:00:06,683
So if we go into my user groups right now,

3
00:00:09,650 --> 00:00:12,410
I can see that my group admin contains,

4
00:00:12,410 --> 00:00:14,140
and this UI is a bit bugged,

5
00:00:14,140 --> 00:00:16,110
contains one user, Stephane.

6
00:00:16,110 --> 00:00:19,180
So if I go on the right hand side and go to my services

7
00:00:19,180 --> 00:00:22,863
and I go to IAM, so I'll go to the IAM service.

8
00:00:23,900 --> 00:00:24,760
I will show you one thing.

9
00:00:24,760 --> 00:00:26,990
So, this user is an admin user.

10
00:00:26,990 --> 00:00:29,320
And therefore, if you go to, for example, users,

11
00:00:29,320 --> 00:00:30,640
you can see all the users.

12
00:00:30,640 --> 00:00:31,640
Okay, great.

13
00:00:31,640 --> 00:00:33,220
So, now what I'm going to do is I'm going

14
00:00:33,220 --> 00:00:36,504
to remove Stephane from the admin groups.

15
00:00:36,504 --> 00:00:37,411
I'm going to remove this user

16
00:00:37,411 --> 00:00:40,632
and the user will lose the group permissions, that's true.

17
00:00:40,632 --> 00:00:43,010
So the user has been removed from the group

18
00:00:43,010 --> 00:00:45,430
and how do we make sure that this is applied?

19
00:00:45,430 --> 00:00:46,810
Well, if I go on the right-hand side

20
00:00:46,810 --> 00:00:50,500
and now refresh this page, as you can see,

21
00:00:50,500 --> 00:00:53,140
I need permissions to access this page

22
00:00:53,140 --> 00:00:55,460
and my user Stephane is not authorized

23
00:00:55,460 --> 00:00:59,400
to perform IamListUsers on this page.

24
00:00:59,400 --> 00:01:00,233
So that makes sense, right?

25
00:01:00,233 --> 00:01:03,310
Because we removed the user Stephane from the admins group.

26
00:01:03,310 --> 00:01:05,480
So, what I can do is I can fix this

27
00:01:05,480 --> 00:01:07,853
and to fix it, I can go into my users.

28
00:01:09,910 --> 00:01:12,540
Go to Stephane and now I can attach permissions

29
00:01:12,540 --> 00:01:14,380
directly to my Stefane user.

30
00:01:14,380 --> 00:01:17,760
So two ways of doing so, number one is to add permissions

31
00:01:17,760 --> 00:01:21,030
and use policies that already exists or that you created

32
00:01:21,030 --> 00:01:23,240
or add an inline policy to just add policies

33
00:01:23,240 --> 00:01:25,040
directly to the user.

34
00:01:25,040 --> 00:01:27,060
So, I'm going to add permissions

35
00:01:27,060 --> 00:01:29,860
and I'm going to attach existing policies directly

36
00:01:29,860 --> 00:01:31,750
and I will search for IAM.

37
00:01:31,750 --> 00:01:34,910
And I'm going to look for IAM read-only access.

38
00:01:34,910 --> 00:01:37,690
I review, I add these permissions

39
00:01:37,690 --> 00:01:41,000
and now my user Stephane has IAM read only access.

40
00:01:41,000 --> 00:01:42,040
What does that mean?

41
00:01:42,040 --> 00:01:45,020
That means that, for example, if I refresh this page...

42
00:01:47,340 --> 00:01:50,480
Then, as we can see, the user Stephane does exist.

43
00:01:50,480 --> 00:01:52,510
But, for example, if I go to groups

44
00:01:53,960 --> 00:01:58,534
and I try to create a group and call it "developers"

45
00:01:58,534 --> 00:02:00,440
and create this group,

46
00:02:00,440 --> 00:02:01,920
I'm going to get an exception

47
00:02:01,920 --> 00:02:04,220
because I'm not authorized to do create group,

48
00:02:04,220 --> 00:02:08,250
I was only authorized to have read-only access to IAM.

49
00:02:08,250 --> 00:02:11,560
So this really shows the power of IAM and so on.

50
00:02:11,560 --> 00:02:15,473
So, now if I go to my user groups, I can do two things.

51
00:02:15,473 --> 00:02:17,060
So number one, I can go

52
00:02:17,060 --> 00:02:19,470
into the admin group and I'm going to add back

53
00:02:19,470 --> 00:02:22,880
this Stephane user so that we have administrator access.

54
00:02:22,880 --> 00:02:24,640
The second thing I'm going to do is I'm going to

55
00:02:24,640 --> 00:02:27,131
create a group named "developers".

56
00:02:27,131 --> 00:02:31,060
And I'm also going to add Stephane into this group

57
00:02:31,060 --> 00:02:33,270
and I'm going to attach a policy,

58
00:02:33,270 --> 00:02:34,930
whatever the first policy I found

59
00:02:34,930 --> 00:02:36,742
it was direct connect to read only access

60
00:02:36,742 --> 00:02:38,480
and then create this group.

61
00:02:38,480 --> 00:02:40,070
It doesn't matter which policy you're attached to,

62
00:02:40,070 --> 00:02:42,060
I just want to show you a behavior.

63
00:02:42,060 --> 00:02:43,150
Okay so, now we have two groups,

64
00:02:43,150 --> 00:02:45,130
we have the admins and the developers,

65
00:02:45,130 --> 00:02:48,600
and the user Stephane is in both groups.

66
00:02:48,600 --> 00:02:49,790
So what's going to happen is

67
00:02:49,790 --> 00:02:51,960
that if I click on the user Stephane

68
00:02:51,960 --> 00:02:55,650
and look at the policies it has, it has three policies.

69
00:02:55,650 --> 00:02:59,890
One that was attached directly named IAM ReadOnlyAccess.

70
00:02:59,890 --> 00:03:01,940
One that was in two that were in Attached From Groups.

71
00:03:01,940 --> 00:03:05,490
The first one is administrator access from the group admin.

72
00:03:05,490 --> 00:03:08,350
And this one, it was direct connect read only access.

73
00:03:08,350 --> 00:03:09,930
from the group's developers.

74
00:03:09,930 --> 00:03:12,130
So, as we can see, the policies get inherited

75
00:03:12,130 --> 00:03:15,563
in different ways through the IAM permissions.

76
00:03:16,920 --> 00:03:19,530
So finally, I want to show you how policies work.

77
00:03:19,530 --> 00:03:20,919
So if you go to policies,

78
00:03:20,919 --> 00:03:23,560
we have a list of all the policies available

79
00:03:23,560 --> 00:03:26,040
within AWS right here, their managed policy.

80
00:03:26,040 --> 00:03:27,850
So this one is administrator access

81
00:03:27,850 --> 00:03:29,440
and we've been using it before.

82
00:03:29,440 --> 00:03:32,540
And if you look at the policy, JSON forum, as we can see

83
00:03:32,540 --> 00:03:35,130
we have a version and we have a statement

84
00:03:35,130 --> 00:03:37,330
that statement contains one statements

85
00:03:37,330 --> 00:03:38,980
and the effect is allowed.

86
00:03:38,980 --> 00:03:41,120
So to authorize action is "*",

87
00:03:41,120 --> 00:03:43,600
that means any action resource is "*",

88
00:03:43,600 --> 00:03:45,160
that means any resource.

89
00:03:45,160 --> 00:03:48,590
So we allow all the actions on all the resources

90
00:03:48,590 --> 00:03:53,090
therefore making this policy an administrator access policy.

91
00:03:53,090 --> 00:03:55,300
We can go into policy summary as well

92
00:03:55,300 --> 00:03:57,100
and this is another view of the policy.

93
00:03:57,100 --> 00:04:01,330
We have allow on 284 services of 284.

94
00:04:01,330 --> 00:04:03,230
Now services get added all the time,

95
00:04:03,230 --> 00:04:04,580
so if you don't have the same number,

96
00:04:04,580 --> 00:04:07,190
don't worry, the course is up to date.

97
00:04:07,190 --> 00:04:09,550
So we can have a look at another policy.

98
00:04:09,550 --> 00:04:11,930
For example, the IAM read only policy

99
00:04:11,930 --> 00:04:13,970
that we've dealt with from before.

100
00:04:13,970 --> 00:04:17,230
So, this time allows one service out of 284,

101
00:04:17,230 --> 00:04:18,220
which is IAM.

102
00:04:18,220 --> 00:04:20,220
And if we look at the JSON documents,

103
00:04:20,220 --> 00:04:22,890
we can see all the actions that are authorized

104
00:04:22,890 --> 00:04:25,050
by this IAM read only access.

105
00:04:25,050 --> 00:04:26,700
So we get, for example, iam:get*,

106
00:04:26,700 --> 00:04:29,520
the star GenerateCredentialsReport,

107
00:04:29,520 --> 00:04:31,850
and so on, on the resource start.

108
00:04:31,850 --> 00:04:34,190
There's also a way for you to create your own policy.

109
00:04:34,190 --> 00:04:36,937
So you can go back to your policies and create a policy

110
00:04:36,937 --> 00:04:38,550
and you have two ways of doing it.

111
00:04:38,550 --> 00:04:41,480
Either, you want to write plain and simple JSON

112
00:04:41,480 --> 00:04:43,350
or you can use the visual editor,

113
00:04:43,350 --> 00:04:44,183
and this is quite handy.

114
00:04:44,183 --> 00:04:46,579
For example, we can choose the service IAM,,

115
00:04:46,579 --> 00:04:48,370
then we can choose an action.

116
00:04:48,370 --> 00:04:51,550
And we can, for example, do a list user,

117
00:04:51,550 --> 00:04:53,600
so I can filter for list users

118
00:04:53,600 --> 00:04:57,600
for effects and I can do get user.

119
00:04:57,600 --> 00:05:00,860
So, let's say we want to add these two actions

120
00:05:00,860 --> 00:05:04,050
and on the resources we can specify specific resources

121
00:05:04,050 --> 00:05:05,740
or all resources.

122
00:05:05,740 --> 00:05:09,260
We could also specify a request condition if we wanted to.

123
00:05:09,260 --> 00:05:10,110
So, once we've done that

124
00:05:10,110 --> 00:05:11,470
if we go to the JSON documents

125
00:05:11,470 --> 00:05:15,444
as we can see the visual editor SID was added,

126
00:05:15,444 --> 00:05:17,279
which has the statement ID,

127
00:05:17,279 --> 00:05:19,440
and we have two actions that were added.

128
00:05:19,440 --> 00:05:22,160
So IAM list users and get users on resource start.

129
00:05:22,160 --> 00:05:24,350
So it's quite a handy way to generate JSON directly

130
00:05:24,350 --> 00:05:25,543
from the visual editor.

131
00:05:26,770 --> 00:05:28,640
Okay. So, just to finish this lecture,

132
00:05:28,640 --> 00:05:30,610
let's do a few things.

133
00:05:30,610 --> 00:05:33,390
In user groups, I'm going to delete the developers group

134
00:05:33,390 --> 00:05:34,223
cause I don't need it

135
00:05:34,223 --> 00:05:35,370
and I need you to type the name of the group,

136
00:05:35,370 --> 00:05:39,300
so I will type developers and click on deletes.

137
00:05:39,300 --> 00:05:41,730
And also on my user as Stephane,

138
00:05:41,730 --> 00:05:44,410
I'm going to remove the policy that was attached directly

139
00:05:44,410 --> 00:05:46,720
because we don't need this IAM read only policy,

140
00:05:46,720 --> 00:05:49,840
I will just remove it and we're good to go.

141
00:05:49,840 --> 00:05:52,840
So, now my user Stephane has a full administrator access

142
00:05:52,840 --> 00:05:54,870
because it is inherited from the admin group.

143
00:05:54,870 --> 00:05:58,360
And so obviously if I go back to my IAM

144
00:05:58,360 --> 00:05:59,640
also on the right side,

145
00:05:59,640 --> 00:06:02,170
as we can see, everything is working just fine.

146
00:06:02,170 --> 00:06:04,150
So I will refresh and here we go,

147
00:06:04,150 --> 00:06:05,068
things are working.

148
00:06:05,068 --> 00:06:06,690
So that's it for this lecture.

149
00:06:06,690 --> 00:06:07,523
I hope you liked it

150
00:06:07,523 --> 00:06:09,370
and I will see you in the next lecture.