WEBVTT 1 00:04:31.800 --> 00:04:32.880 matt: Hello. 2 00:15:29.510 --> 00:15:31.149 A1CE Lecture 2: Hello, hold on. Oh. 3 00:15:31.270 --> 00:15:32.869 A1CE Lecture 2: Okay, thank you. 4 00:16:00.890 --> 00:16:06.679 A1CE Lecture 2: Okay, everyone, you know… This out clearly. 5 00:16:20.490 --> 00:16:29.779 A1CE Lecture 2: Again, you can type… In the chat, if you can hear this, clear. 6 00:16:30.850 --> 00:16:31.970 A1CE Lecture 2: Okay, thank you. 7 00:16:32.660 --> 00:16:33.600 A1CE Lecture 2: Okay. 8 00:16:33.930 --> 00:16:36.580 A1CE Lecture 2: Okay. 9 00:16:42.970 --> 00:16:49.530 A1CE Lecture 2: Okay, thank you very much. So, I'm sorry for… Keep you waiting. 10 00:16:50.190 --> 00:16:55.960 A1CE Lecture 2: Okay, so if everyone can hear, clearly, so we can start. 11 00:16:56.260 --> 00:16:59.290 A1CE Lecture 2: Okay. 12 00:17:02.070 --> 00:17:02.940 A1CE Lecture 2: Oops. 13 00:17:11.800 --> 00:17:16.710 A1CE Lecture 2: Okay, this is SYS302 Cloud Computing. 14 00:17:26.780 --> 00:17:38.450 A1CE Lecture 2: Me too. Okay, so, for this week, we, as we… Is. Not. 15 00:17:39.120 --> 00:17:46.830 A1CE Lecture 2: Okay… How I can… Good. 16 00:17:49.530 --> 00:17:50.750 A1CE Lecture 2: Okay. 17 00:17:53.300 --> 00:17:59.919 A1CE Lecture 2: Okay, so for this week, as we mentioned before, 18 00:18:00.140 --> 00:18:02.580 A1CE Lecture 2: We will talk about, basic. 19 00:18:02.720 --> 00:18:03.850 A1CE Lecture 2: Security? 20 00:18:12.950 --> 00:18:26.410 A1CE Lecture 2: Right? And the presentation is, I will use this securing the access for AWS Academy Cloud Architect, and I think this is, ACA Model 3, right? 21 00:18:26.480 --> 00:18:40.139 A1CE Lecture 2: But as I mentioned before, we will be talking about, by using this written, slide that I will upload, in… 22 00:18:40.360 --> 00:18:48.799 A1CE Lecture 2: the canvas, right? And, sorry, the record of, the previous week, I also will upload, which had the link. 23 00:18:48.950 --> 00:18:51.289 A1CE Lecture 2: In the canvas, I think. 24 00:18:51.400 --> 00:18:55.299 A1CE Lecture 2: I think during the break, or after today's class, right? 25 00:18:56.220 --> 00:19:14.790 A1CE Lecture 2: Okay, so, let's get started, because I think we… we… before we can set up, and I keep all of you waiting for a long time. First thing is, we're talking about what is the basic security in the cloud. 26 00:19:16.010 --> 00:19:24.069 A1CE Lecture 2: So, this is just, overview. When we try to deploy, 27 00:19:24.510 --> 00:19:33.200 A1CE Lecture 2: any service, anything, any resource that we deploy, for example, if we deploy in AWS, we deploy the source 28 00:19:34.160 --> 00:19:36.139 A1CE Lecture 2: One resource in the cloud. 29 00:19:36.380 --> 00:19:43.549 A1CE Lecture 2: Normally for… it can be, AWS, it can be GCP, it can be Azure. 30 00:19:44.030 --> 00:19:49.150 A1CE Lecture 2: It's… Any of this is, I think, based on the same, 31 00:19:50.440 --> 00:19:57.250 A1CE Lecture 2: Same… the same thing, right? Because we deploy something in the public cloud environment. 32 00:19:59.970 --> 00:20:06.580 A1CE Lecture 2: Right? So, one of, the main… Requirement. 33 00:20:06.680 --> 00:20:13.240 A1CE Lecture 2: Right? When you deploy anything in the cloud, you need… 34 00:20:13.620 --> 00:20:18.169 A1CE Lecture 2: internet access, right? So, I draw the, internet, yeah? 35 00:20:19.490 --> 00:20:20.410 A1CE Lecture 2: So… 36 00:20:20.720 --> 00:20:31.269 A1CE Lecture 2: If you want to access to anything in the cloud, right, you will have to go through the public internet, and go through, 37 00:20:31.580 --> 00:20:36.770 A1CE Lecture 2: The resource that you deploy and available in the cloud. 38 00:20:37.390 --> 00:20:51.560 A1CE Lecture 2: But because you need internet access, right, to access to the cloud service, right? So, it is also possible that there's multiple… it can be multiple users. 39 00:20:52.430 --> 00:21:03.669 A1CE Lecture 2: that also, can access to the internet. And… Very likely that they also can… 40 00:21:04.100 --> 00:21:13.070 A1CE Lecture 2: try to access the resource that you provide and you deploy in the cloud, right? And some users, Right? 41 00:21:13.190 --> 00:21:16.980 A1CE Lecture 2: That… it can be multiple types of user. 42 00:21:24.060 --> 00:21:24.870 A1CE Lecture 2: But… 43 00:21:25.530 --> 00:21:40.440 A1CE Lecture 2: we may not need everyone, right? In some… in some case, it is possible that you want to share the resource that you put in the cloud for everyone, but mostly. 44 00:21:41.050 --> 00:21:46.669 A1CE Lecture 2: normally, we… we don't want everyone, right? Because we just want, 45 00:21:46.990 --> 00:21:51.410 A1CE Lecture 2: the authorized, or the user that, that we 46 00:21:51.510 --> 00:22:07.630 A1CE Lecture 2: allow, right? For example, the client in the green color is the client request that we allow to access your resource in the cloud. And the laptop or the client in red, I think. 47 00:22:08.170 --> 00:22:09.269 A1CE Lecture 2: We don't want. 48 00:22:10.270 --> 00:22:15.360 A1CE Lecture 2: these requests to be able to access the cloud. But okay, you also want 49 00:22:15.470 --> 00:22:30.850 A1CE Lecture 2: because we are, if we run anything in the cloud, we also not, connect directly to the AWS infrastructure, right? We also need to access, if we are admin or cloud admin. 50 00:22:30.990 --> 00:22:45.489 A1CE Lecture 2: We also need to access the resource that we deploy in the cloud, right? So we want some of the requests to be able to access to the cloud, and some of the requests we want to prevent. 51 00:22:45.840 --> 00:22:46.610 A1CE Lecture 2: Right. 52 00:22:46.720 --> 00:22:58.620 A1CE Lecture 2: So… To do this, This is the basic security requirement, right? It's… is called, access control, right? 53 00:23:00.790 --> 00:23:10.329 A1CE Lecture 2: It's very basic, security process, but it's quite important in the cloud because we want to perform 54 00:23:11.320 --> 00:23:20.070 A1CE Lecture 2: effective access control. We want to make sure, right, the main objective Right. 55 00:23:20.250 --> 00:23:23.080 A1CE Lecture 2: the main… Objective. 56 00:23:25.230 --> 00:23:27.340 A1CE Lecture 2: of access control. 57 00:23:31.570 --> 00:23:36.860 A1CE Lecture 2: Is too only… Allow? 58 00:23:37.540 --> 00:23:39.460 A1CE Lecture 2: authorize… 59 00:23:45.320 --> 00:23:46.320 A1CE Lecture 2: User? 60 00:23:46.860 --> 00:23:49.770 A1CE Lecture 2: Or, it can be application. 61 00:23:54.880 --> 00:23:56.819 A1CE Lecture 2: to access. 62 00:23:58.250 --> 00:23:59.380 A1CE Lecture 2: plow? 63 00:23:59.680 --> 00:24:00.760 A1CE Lecture 2: resource. 64 00:24:10.300 --> 00:24:21.380 A1CE Lecture 2: But also, within, specific level of… Access. 65 00:24:21.720 --> 00:24:28.240 A1CE Lecture 2: So, we want to make sure that only the… 66 00:24:28.740 --> 00:24:35.930 A1CE Lecture 2: the authorized client, for example. Authorized client is… This one? 67 00:24:38.090 --> 00:24:49.610 A1CE Lecture 2: authorized clients, authorized clients, and we want to prevent, right, unauthorized access from this user. 68 00:24:51.570 --> 00:24:56.530 A1CE Lecture 2: And this user, we will prevent, right? But… 69 00:24:56.530 --> 00:25:13.800 A1CE Lecture 2: in order to access, right? It may… we can control that, okay, even this client and this client, we allow to access the resource in the cloud. We may just say that, okay, for the clean client. 70 00:25:16.200 --> 00:25:18.140 A1CE Lecture 2: It should be… 71 00:25:19.990 --> 00:25:39.700 A1CE Lecture 2: read only, right? And for us, that… maybe we are admin, right? So, for admin, we can read and write at the resource, right? So, to do… to perform access control, we want to make sure that we only 72 00:25:39.750 --> 00:25:42.069 A1CE Lecture 2: Allow. Authorize. 73 00:25:42.450 --> 00:26:01.250 A1CE Lecture 2: user to be… to be able to access the cloud resource, but within specific level of access, right? So, this is, the basic security requirement that we need to implement in the cloud, right? 74 00:26:01.590 --> 00:26:04.080 A1CE Lecture 2: But you may think, why? 75 00:26:04.440 --> 00:26:14.049 A1CE Lecture 2: why we need… why we not allow everyone to be able to access the resource? And why I say that, in some cases, you may… 76 00:26:14.190 --> 00:26:19.520 A1CE Lecture 2: possible, allow everyone to access the resource. But… 77 00:26:20.440 --> 00:26:29.280 A1CE Lecture 2: why I said that, in many cases, we don't want everyone to be able to access, right? Because, 78 00:26:30.680 --> 00:26:38.190 A1CE Lecture 2: But this is just one of the reasons, right? It's not everything, but one of the reasons 79 00:26:39.010 --> 00:26:42.260 A1CE Lecture 2: One of the reasons 80 00:26:46.240 --> 00:26:51.190 A1CE Lecture 2: That… V… Done one. 81 00:26:53.680 --> 00:26:54.660 A1CE Lecture 2: Everyone. 82 00:26:58.300 --> 00:27:00.130 A1CE Lecture 2: to access. 83 00:27:01.930 --> 00:27:03.490 A1CE Lecture 2: to cloud resource. 84 00:27:09.510 --> 00:27:12.310 A1CE Lecture 2: Can you… Can you… 85 00:27:13.080 --> 00:27:20.469 A1CE Lecture 2: Can anyone think of why… why we don't want everyone to be able to access our cloud resources? 86 00:27:24.270 --> 00:27:26.110 matt: People can just, rack up the credit. 87 00:27:26.110 --> 00:27:26.780 A1CE Lecture 2: Oh, okay. 88 00:27:27.380 --> 00:27:36.109 A1CE Lecture 2: But yeah, yeah, if, that information that we put in the cloud is, 89 00:27:36.500 --> 00:27:43.139 A1CE Lecture 2: sensitive information and contains some personal information. Yes, we don't want, 90 00:27:43.560 --> 00:27:51.830 A1CE Lecture 2: people that we not… not trust to be able to access. But if it just… 91 00:27:52.940 --> 00:27:57.670 A1CE Lecture 2: Okay, not… not sensitive information. 92 00:28:01.090 --> 00:28:06.220 A1CE Lecture 2: What is the… maybe the… the reason that we… we want to prevent? 93 00:28:10.980 --> 00:28:25.919 A1CE Lecture 2: Okay, okay, Matt, thank you. People may use the compute credit for free. Yes, in a way, yes. And also, I think, for my reason, yes, it's about cost, right? Because… 94 00:28:27.320 --> 00:28:36.759 A1CE Lecture 2: If even the service that we provide in the cloud, or the information that we put in the cloud, is… 95 00:28:36.780 --> 00:28:51.989 A1CE Lecture 2: the information that can be provided to anyone, but if many clients or many users try to read, right, try to read the data, that you, maybe you keep, maybe, 96 00:28:52.290 --> 00:29:00.449 A1CE Lecture 2: for example, because I think the last 3 days, my son just entered the national… 97 00:29:00.730 --> 00:29:12.849 A1CE Lecture 2: shares competition, and it, it, it used S3 to host, the competition result, right? So that, that is… 98 00:29:13.270 --> 00:29:20.359 A1CE Lecture 2: the competition result is… is the topic, right? Anyone can access. But… 99 00:29:20.530 --> 00:29:39.699 A1CE Lecture 2: they can do it, because I think it's only maybe not… not about thousands of people that try to access that, information, so it's not causing much, but… but, if there are a lot of requests, what gonna happen 100 00:29:39.700 --> 00:29:48.289 A1CE Lecture 2: is… maybe I just tried to choose… the data transfer. If you have… this is maybe the result, right? 101 00:29:49.060 --> 00:29:59.799 A1CE Lecture 2: And if many people try to download, we have to deliver that to the client, right? So, if this happens, is… 102 00:30:00.460 --> 00:30:04.889 A1CE Lecture 2: data transfer, right? So, for… 103 00:30:05.380 --> 00:30:09.669 A1CE Lecture 2: My son shares result? Yes, maybe? 104 00:30:11.320 --> 00:30:16.910 A1CE Lecture 2: hundreds of requests, right, to shake, and… because I'm… I never shake. 105 00:30:17.490 --> 00:30:29.029 A1CE Lecture 2: I just want to see, because there is a pairing, and it is a responsibility of the parent that I have to take my son, to the correct seat. 106 00:30:29.110 --> 00:30:40.259 A1CE Lecture 2: Right? And I have to check whether, okay, this route, my son is white inboard 2, or something like that. I have to check the website, and I just… 107 00:30:40.730 --> 00:30:56.489 A1CE Lecture 2: request for one time in the morning, and I'm just using that, right? And I never look at anything, so it's okay, it's possible, to share that to anyone, because I don't have to authenticate, or I don't have to provide 108 00:30:56.490 --> 00:31:00.900 A1CE Lecture 2: any information, and I can see, the website. 109 00:31:01.040 --> 00:31:02.540 A1CE Lecture 2: But… 110 00:31:03.010 --> 00:31:18.699 A1CE Lecture 2: In many cases, right, if there are a lot of data transfer, right, a lot of requests, I mean, millions of requests. So, the data transfer price will significantly increase. 111 00:31:18.700 --> 00:31:36.310 A1CE Lecture 2: Right? So, that… that's why it's one of the main reasons that… why is it important to provide access control? We… because we want to allow only authorized users to use our cloud resource, right? Because, 112 00:31:36.430 --> 00:31:37.740 A1CE Lecture 2: Mall? 113 00:31:38.080 --> 00:31:39.270 A1CE Lecture 2: Clough? 114 00:31:40.070 --> 00:31:41.160 A1CE Lecture 2: usage. 115 00:31:41.370 --> 00:31:49.340 A1CE Lecture 2: Right? From anyone, right? It means more cause Taboo, pay. 116 00:31:49.470 --> 00:31:51.430 A1CE Lecture 2: Right? So, this is… 117 00:31:51.700 --> 00:32:06.320 A1CE Lecture 2: why this is quite important, right? We want to make sure that we can control the access to the cloud resource that we have. And this is quite important because, it's… 118 00:32:06.610 --> 00:32:25.060 A1CE Lecture 2: I think it's the main component in any type of implementation. If you want to use the cloud as to host the website, or the web application, or you want to do the big data 119 00:32:26.280 --> 00:32:44.720 A1CE Lecture 2: big data process, right? So, create data lake, control the access for multiple types of data source. You want to work in machine learning, AI, and you also have to control, right, to perform some level of the access control. So. 120 00:32:44.970 --> 00:32:57.589 A1CE Lecture 2: in any type of implementation, access control is, I think, one of a key component that you need to understand and you apply this 121 00:32:57.600 --> 00:33:09.589 A1CE Lecture 2: knowledge to, what you will implement in any… any cloud, right? It's the same, right? So we want to make sure that we understand, 122 00:33:09.920 --> 00:33:14.779 A1CE Lecture 2: What the access control in the cloud, perform, right? 123 00:33:15.680 --> 00:33:25.119 A1CE Lecture 2: Okay, so that is why, why this, is important, and why we discussed this 124 00:33:26.470 --> 00:33:45.080 A1CE Lecture 2: for the first topic, right? Not… the first… the first way is just introduction, but for, before we talk into… talk about any topic in the cloud, I think this basic security or access control is the main thing, right? So. 125 00:33:46.050 --> 00:33:52.439 A1CE Lecture 2: we look about, what is access control, and I think Many of you met. 126 00:33:52.560 --> 00:34:04.769 A1CE Lecture 2: learning about access control already, so just a quick recap, right? For access control, there are two main components, right? The first one is… 127 00:34:05.010 --> 00:34:06.240 A1CE Lecture 2: authentication. 128 00:34:08.440 --> 00:34:17.320 A1CE Lecture 2: Right? And this is about who, right? Who is allow. Allow to access. 129 00:34:17.449 --> 00:34:18.159 A1CE Lecture 2: Right. 130 00:34:20.560 --> 00:34:24.819 A1CE Lecture 2: is about who, normally, authentication. But… 131 00:34:25.010 --> 00:34:34.710 A1CE Lecture 2: for authenticate, right? We need, basically, two things, right? It's about… Identity? 132 00:34:35.010 --> 00:34:35.710 A1CE Lecture 2: Right. 133 00:34:36.260 --> 00:34:46.989 A1CE Lecture 2: And… The thing that we use to, prove that we are this identity, which is… Queen, too, right? 134 00:34:47.170 --> 00:35:06.549 A1CE Lecture 2: So, we need the combination of identity and credential to successfully authenticate, right? To prove to the system, or prove to… before we can enter to AWS environment, that we are 135 00:35:07.530 --> 00:35:26.709 A1CE Lecture 2: the person or the user or the application that allow to access the resource, right? We need identity and credential, right? For AWS or any cloud, it's quite similar, right? There are two types of identity. 136 00:35:27.480 --> 00:35:31.700 A1CE Lecture 2: One is for long-term, right? 137 00:35:32.990 --> 00:35:36.269 A1CE Lecture 2: And other one is shuttle. 138 00:35:36.530 --> 00:35:37.220 A1CE Lecture 2: item. 139 00:35:37.320 --> 00:35:51.929 A1CE Lecture 2: So, in AWS, or I think same with other cloud, there are two types of identity. Identity that you can use long-term, and identity that you can use for short-term. 140 00:35:53.190 --> 00:35:58.669 A1CE Lecture 2: In general, for long term, normally it's the identity for 141 00:35:59.070 --> 00:36:13.519 A1CE Lecture 2: human, right? So, for us, for us to work in the cloud environment, normally we need long-term, right? We need to sign in one time, and it's work for the whole days, and we don't have to, authenticate again. 142 00:36:13.520 --> 00:36:21.059 A1CE Lecture 2: Right? Normally, when you log in to AWS environment using long-term identity, normally. 143 00:36:21.120 --> 00:36:29.729 A1CE Lecture 2: you will be able to access, AWS environment for, normally, whole days, right? And you have to attend again. 144 00:36:30.100 --> 00:36:46.280 A1CE Lecture 2: Maybe, the next day when you try to log in to AWS again, okay, that… that is when you have to authenticate again, right? And for short-term, normally it's for application, right? Because 145 00:36:46.410 --> 00:36:55.840 A1CE Lecture 2: when some applications want to access AWS service, we may provide just shutter, because 146 00:36:56.770 --> 00:36:59.800 A1CE Lecture 2: This is the application, so anyone can… 147 00:37:00.300 --> 00:37:07.980 A1CE Lecture 2: anyone can access, or anyone can request to access AWS service, because, yeah. 148 00:37:08.230 --> 00:37:23.410 A1CE Lecture 2: to access AWS, you can come from any… anywhere from in the internet, and you can try to access the cloud resource, right? So, for application or service that you deploy, and you may need to access 149 00:37:23.410 --> 00:37:31.150 A1CE Lecture 2: some service in the cloud, we may provide something like short-term identity to just 150 00:37:31.150 --> 00:37:43.610 A1CE Lecture 2: authentication for this request, right? And if you want to access again, you have to authenticate again, right? Because it's a machine. We want to, 151 00:37:43.800 --> 00:37:48.389 A1CE Lecture 2: to authenticate every request, right? Because… 152 00:37:49.130 --> 00:37:59.740 A1CE Lecture 2: It's more… if in terms of identity and also credential, credentials also have the same thing that we… because if you use long-term identity. 153 00:37:59.860 --> 00:38:10.980 A1CE Lecture 2: We also have to pair with long-term credential, and if you use short-term identity, and you work with short-term credential. 154 00:38:11.030 --> 00:38:30.410 A1CE Lecture 2: Right? So, it's just something like per request, right? One request, you authenticate. And if you want to access again, you just have to authenticate again, because what you use is the short-term identity and also short-term credential, and you have to authenticate per request, right? 155 00:38:30.410 --> 00:38:33.720 A1CE Lecture 2: And… If you want more security. 156 00:38:33.920 --> 00:38:42.379 A1CE Lecture 2: If the security is much more, strict, or you want high level of security. 157 00:38:42.790 --> 00:38:52.330 A1CE Lecture 2: short-term, right? Short-term identity and short-term credential is, preferred, right? But… is, is… 158 00:38:52.500 --> 00:38:57.869 A1CE Lecture 2: similar to anything, if you try to say that. 159 00:38:58.050 --> 00:39:04.350 A1CE Lecture 2: Short-term identity and short-term credential is preferred, because it's more secure, because 160 00:39:04.740 --> 00:39:24.310 A1CE Lecture 2: if you… you cannot reuse, you… you cannot just, if the credential is compromised, if it is short-term, right? If the credential is compromised, it may expire in 1 hour, it can expire in 4 hours. So… 161 00:39:24.740 --> 00:39:31.649 A1CE Lecture 2: The compromise of credential may not significantly, 162 00:39:31.770 --> 00:39:44.469 A1CE Lecture 2: create much damage to the system, right? Because the credential will be expired in really short period of time, right? But it will be difficult to manage, because 163 00:39:44.590 --> 00:39:58.680 A1CE Lecture 2: if you use short-term identity and short-term credential, so it's a lot of credential that you have to manage, right? So you need something to… to help you effectively manage. 164 00:39:58.750 --> 00:40:08.300 A1CE Lecture 2: the short-term current year. So, that… that is something, like, trade-off that I think for… In any engineering. 165 00:40:08.960 --> 00:40:14.149 A1CE Lecture 2: Topic. We have to face in about how we can trade off. 166 00:40:14.470 --> 00:40:23.889 A1CE Lecture 2: Because when we… when we get something, if we get benefit from something, it will create some drawback. 167 00:40:24.030 --> 00:40:29.710 A1CE Lecture 2: That we need to make sure that we balance the threat of Right. 168 00:40:29.930 --> 00:40:41.730 A1CE Lecture 2: Right? Because this is one of the examples. Yeah, short-term credential, short-term identity is better in terms of security, but you have to work with a lot of 169 00:40:41.950 --> 00:40:53.300 A1CE Lecture 2: Credential, and how we make sure that we can effectively manage this is something that we have to, need to take into the consideration. 170 00:40:54.000 --> 00:41:08.170 A1CE Lecture 2: Okay, so this is authentication, right? So, we know about long-term and also short-term, right? And the next thing is, the second part, but this only happened 171 00:41:08.830 --> 00:41:21.030 A1CE Lecture 2: After… you successfully authenticate, right? When you successfully authenticate, you can go to the next, step, is authorization. 172 00:41:27.810 --> 00:41:34.940 A1CE Lecture 2: Okay. For authorization is about which Level? 173 00:41:35.440 --> 00:41:37.820 A1CE Lecture 2: of… Access. 174 00:41:41.170 --> 00:41:46.840 A1CE Lecture 2: Is allow, right? 175 00:41:47.470 --> 00:41:57.119 A1CE Lecture 2: Okay, so authorization is, okay, if you are authenticated user, you can access the resource, but you can access the resource as 176 00:41:57.260 --> 00:42:07.839 A1CE Lecture 2: Which level, and… Which level, or… and also, which… resource, right? So… 177 00:42:08.470 --> 00:42:20.619 A1CE Lecture 2: how many resources that you can access, and at which level, right? So this is authorization. So normally it's in the form of… 178 00:42:20.810 --> 00:42:28.930 A1CE Lecture 2: policy, right? It's about the policy that allows All. Deny. 179 00:42:30.000 --> 00:42:31.060 A1CE Lecture 2: Access. 180 00:42:32.560 --> 00:42:42.510 A1CE Lecture 2: 2… wish… resource… And… level. 181 00:42:44.260 --> 00:42:46.639 A1CE Lecture 2: of access, right? 182 00:42:46.820 --> 00:42:56.739 A1CE Lecture 2: So, the policy will be mapping with identity, so any identity That is authenticated, right? 183 00:42:57.230 --> 00:42:58.460 A1CE Lecture 2: Authenticate. 184 00:43:00.140 --> 00:43:09.469 A1CE Lecture 2: Identity must be mapping with policy, right? So, when you've, successfully authenticated. 185 00:43:09.650 --> 00:43:14.030 A1CE Lecture 2: It will be checked that, okay, this user is authenticated, right? 186 00:43:14.300 --> 00:43:28.599 A1CE Lecture 2: and authorized. But which level of this user can access the resource is specified in the policy that will attach to that identity, right? So it will provide 187 00:43:29.310 --> 00:43:36.239 A1CE Lecture 2: The effect, which is allow or deny, right? And allow or deny to access 188 00:43:37.170 --> 00:43:43.259 A1CE Lecture 2: how many resources? It can be one resource, it can be two resources, three resources, or 189 00:43:43.810 --> 00:43:48.440 A1CE Lecture 2: At what level of access that it will be allowed. 190 00:43:48.780 --> 00:43:51.789 A1CE Lecture 2: Right? Levi always says, normally, it's read. 191 00:43:51.900 --> 00:43:55.080 A1CE Lecture 2: With only or full access is to break right. 192 00:43:55.200 --> 00:43:55.880 A1CE Lecture 2: Right. 193 00:43:56.350 --> 00:44:07.220 A1CE Lecture 2: So, this is authorization, right? And how it… how AWS and also other cloud providers implement this access control. 194 00:44:07.670 --> 00:44:12.609 A1CE Lecture 2: It will be implemented. 195 00:44:14.720 --> 00:44:15.570 A1CE Lecture 2: Matis nich. 196 00:44:15.690 --> 00:44:17.079 A1CE Lecture 2: Maybe not this color. 197 00:44:17.430 --> 00:44:30.250 A1CE Lecture 2: It will be implemented before you can access AWS or any cloud environment, because all cloud providers, you can access by… 198 00:44:31.820 --> 00:44:45.800 A1CE Lecture 2: connect to AWS API, Google Cloud API, Microsoft Azure API, and at that AWS API, or any Cloud API, the access control is implemented 199 00:44:46.690 --> 00:44:53.460 A1CE Lecture 2: at this API, right? Before the request from the client can 200 00:44:53.600 --> 00:45:13.370 A1CE Lecture 2: be sent to the resource in the cloud, right? It have to pass through the cloud API first. So, this is when… this is where the access control is implemented, is at the API of the cloud, right? And the process for, 201 00:45:13.580 --> 00:45:23.380 A1CE Lecture 2: access control in many cloud providers, AWS and TCP using the same name, is identity and access management. 202 00:45:23.560 --> 00:45:29.800 A1CE Lecture 2: In short, I call IAM, right? So… When you look at 203 00:45:30.840 --> 00:45:42.129 A1CE Lecture 2: Access control in the cloud, normally, this is, okay, for AWS, the name is… for the service is Identity, right? 204 00:45:42.720 --> 00:45:46.490 A1CE Lecture 2: identity and… Access management. 205 00:45:51.530 --> 00:45:58.489 A1CE Lecture 2: Or, in short, is IAM, or IAM, right? Identity and Access Management. 206 00:45:59.700 --> 00:46:10.200 A1CE Lecture 2: Okay, so it is quite, simple, because if you look at identity, yes, identity is authentic, right? 207 00:46:10.900 --> 00:46:15.050 A1CE Lecture 2: And access management, yes, this is authorization. 208 00:46:15.540 --> 00:46:24.169 A1CE Lecture 2: So, identity and access management, is about access control. It's about authenticate and authorization. 209 00:46:24.280 --> 00:46:32.620 A1CE Lecture 2: So… Right now, we will be talking about IAM, in AWS. 210 00:46:33.750 --> 00:46:40.229 A1CE Lecture 2: So, the first thing is we're talking about, identity first, right? 211 00:46:41.020 --> 00:46:45.380 A1CE Lecture 2: Identity, that… AWS. 212 00:46:45.840 --> 00:46:46.750 A1CE Lecture 2: support. 213 00:46:46.980 --> 00:46:47.670 A1CE Lecture 2: Bye. 214 00:46:49.010 --> 00:47:00.790 A1CE Lecture 2: there's multiple identity that sub-AWS support. It means you can use that in AWS environment, right? The first one is… 215 00:47:02.570 --> 00:47:03.850 A1CE Lecture 2: I am using. 216 00:47:04.530 --> 00:47:05.260 A1CE Lecture 2: Right? 217 00:47:05.530 --> 00:47:11.570 A1CE Lecture 2: The second one… is… I am… role. 218 00:47:11.910 --> 00:47:12.620 A1CE Lecture 2: Bye. 219 00:47:13.190 --> 00:47:19.409 A1CE Lecture 2: And the third one is also from the IAM, is IAM… 220 00:47:19.660 --> 00:47:24.960 A1CE Lecture 2: And right now, they're using the name Iam User Group. 221 00:47:25.420 --> 00:47:31.059 A1CE Lecture 2: Right. So, identity… That you can create. 222 00:47:31.260 --> 00:47:42.429 A1CE Lecture 2: And manage in… identity and access management in AWS is you have 3 types of identity. I am user. 223 00:47:42.880 --> 00:47:48.620 A1CE Lecture 2: I am role, and I am user group, right? You can create 224 00:47:48.680 --> 00:48:04.449 A1CE Lecture 2: delete, modify, or anything, right, that's possible in identity and access management in AWS. This is the three local identity that you can create in 225 00:48:04.530 --> 00:48:08.030 A1CE Lecture 2: the IAM service in AWS, and 226 00:48:08.140 --> 00:48:14.380 A1CE Lecture 2: This is not… for AWS, it's not many services, but I am in AWS is… 227 00:48:15.090 --> 00:48:23.539 A1CE Lecture 2: global service, right? What it means here is you can create IAM user. 228 00:48:23.660 --> 00:48:31.939 A1CE Lecture 2: And you can then use that IAM user with The service in every region. 229 00:48:32.330 --> 00:48:48.330 A1CE Lecture 2: in your AWS account, right? Because it's a global service. You set one time, and you can use that identity in any region that AWS has right now, right? It's global service. 230 00:48:49.680 --> 00:48:59.970 A1CE Lecture 2: But AWS not only supports the local identity that you can create in IAM, the fourth identity. 231 00:49:00.160 --> 00:49:05.870 A1CE Lecture 2: That you can use is… Federet. 232 00:49:06.190 --> 00:49:07.690 A1CE Lecture 2: user, I think. 233 00:49:07.800 --> 00:49:14.249 A1CE Lecture 2: So, what… what is federate user, right? Federate user is mean the… 234 00:49:15.020 --> 00:49:26.839 A1CE Lecture 2: the identity that's in the domain that is outside AWS, right? I just provide you some… 235 00:49:28.070 --> 00:49:40.190 A1CE Lecture 2: if you have AWS here, and you have IAM, which is a global process that you can create anything inside AWS environment, but 236 00:49:40.340 --> 00:49:50.840 A1CE Lecture 2: If, for example, if I manage, AWS environment in my school of IT, right, I don't want, 237 00:49:51.370 --> 00:50:02.320 A1CE Lecture 2: any stuff to… to have two identity, right? Because if I… so, for example, if I am… in… 238 00:50:02.560 --> 00:50:10.049 A1CE Lecture 2: okay, not faculty, not school of IT, maybe… I'm also, in KMIT Highline. 239 00:50:10.740 --> 00:50:16.579 A1CE Lecture 2: So I have a domain, I have email, right? The part.pr. 240 00:50:16.730 --> 00:50:18.660 A1CE Lecture 2: at KMATL. 241 00:50:19.140 --> 00:50:27.720 A1CE Lecture 2: ac.ch, right? So, if I don't connect my… 242 00:50:27.950 --> 00:50:45.950 A1CE Lecture 2: identity domain in KMITL, and I have to work with AWS, which is right now. I also have one account, right? And I have one account that I can use to access AWS, right? So I… right now, I use, 243 00:50:46.130 --> 00:50:52.399 A1CE Lecture 2: For example, Lapad at… Test.com. 244 00:50:53.120 --> 00:51:05.519 A1CE Lecture 2: just examples, right? So, if I not connect, when I want to work with AWS, I have to log in with lapart at test.com, and I have credential for that to access AWS. 245 00:51:05.590 --> 00:51:22.100 A1CE Lecture 2: And when I work with KMITL environment, I use labhat.pr at kmitr.ac.th to access KMITL service, right? But if I want, right, to work in AWS environment, but I just want 246 00:51:22.180 --> 00:51:31.819 A1CE Lecture 2: to only have one identity, and this one identity can be used to access KMIGL, and also 247 00:51:31.840 --> 00:51:49.789 A1CE Lecture 2: can use to access AWS environment by using the same identity and credential, right? Which is something like, if I can say, single sign-on, right? You can do that, right? But, the detail, if you want to know. 248 00:51:49.900 --> 00:51:54.879 A1CE Lecture 2: I can provide the link or information, so I will provide the link 249 00:51:55.110 --> 00:52:08.139 A1CE Lecture 2: to work with how, how you can set up that, that you want to perform single sign-on, to AWS environment using federal identity provider. So. 250 00:52:08.530 --> 00:52:19.229 A1CE Lecture 2: that's their step that can help you to set up, or AWS also have some service that can help you, to set up 251 00:52:19.520 --> 00:52:35.920 A1CE Lecture 2: this kind of, requirement that you want, but the main idea is actually you just register, right? You have to connect, right? If the KMATL domain, is Active Directory, I just don' 252 00:52:36.430 --> 00:52:45.820 A1CE Lecture 2: I have to connect, right? Set up my IAM in my AWS account to know that, okay, this is… 253 00:52:46.010 --> 00:53:00.630 A1CE Lecture 2: Federate, identity domain, right? IDP, another IDP outside is Active Directory, and I set up that my identity and access management in my AWS account know about 254 00:53:01.630 --> 00:53:11.860 A1CE Lecture 2: the identity provider in KMITF, right? So, when I try to log in to AWS using this 255 00:53:12.140 --> 00:53:15.860 A1CE Lecture 2: identity for the MITR, so I can send 256 00:53:16.180 --> 00:53:33.669 A1CE Lecture 2: My identity, which is my email, and also credential is password, right? I will submit to AWS, right? And the IAM of my account in AWS will send that identity and credential to check with PMIL. 257 00:53:33.910 --> 00:53:35.190 A1CE Lecture 2: Hi there, AD Silva. 258 00:53:35.610 --> 00:53:38.819 A1CE Lecture 2: And if KMIT have said that, okay. 259 00:53:39.060 --> 00:53:44.210 A1CE Lecture 2: There's a correct hi, Daddy, nice to meet you. 260 00:53:44.550 --> 00:53:50.690 A1CE Lecture 2: I am in the base to say, okay, this is authenticated, right? Successfully authenticated, and… 261 00:53:50.920 --> 00:53:55.039 A1CE Lecture 2: I can allow these users to access the education. 262 00:53:55.510 --> 00:54:04.740 A1CE Lecture 2: So, if you enter database, You can both… you can come from… another… 263 00:54:05.380 --> 00:54:09.630 A1CE Lecture 2: identity provider, right? If you come from an identity provider. 264 00:54:09.740 --> 00:54:12.740 A1CE Lecture 2: you are using Federate using. Oh. 265 00:54:13.630 --> 00:54:17.130 A1CE Lecture 2: Okay, the audio quality went down. 266 00:54:23.440 --> 00:54:27.360 A1CE Lecture 2: just… I think the pathway? 267 00:54:31.300 --> 00:54:35.649 A1CE Lecture 2: Okay, this… is it… it is better? 268 00:54:36.480 --> 00:54:38.470 A1CE Lecture 2: Or you not hear anything. 269 00:54:38.760 --> 00:54:41.419 A1CE Lecture 2: Okay, you can hear now? 270 00:54:41.660 --> 00:54:42.510 A1CE Lecture 2: Okay. 271 00:54:43.610 --> 00:54:46.410 A1CE Lecture 2: Okay, I chained a microphone, so… 272 00:54:46.650 --> 00:54:54.319 A1CE Lecture 2: Thank you very much. If you have a problem with the audio quality, just send… send in the chat, right? 273 00:54:54.440 --> 00:54:55.260 A1CE Lecture 2: Thank you. 274 00:54:55.450 --> 00:54:57.140 A1CE Lecture 2: Okay, so… 275 00:55:00.310 --> 00:55:06.049 A1CE Lecture 2: If… Okay, this is, for federate user, right? 276 00:55:06.410 --> 00:55:10.770 A1CE Lecture 2: And another… Identity, right? 277 00:55:10.900 --> 00:55:21.679 A1CE Lecture 2: Another identity is… AWS, echo… producer, right? 278 00:55:22.090 --> 00:55:34.910 A1CE Lecture 2: So, in this case, it means because in order to use AWS, we can use local identity that you create in IAM, or if I am the account owner. 279 00:55:34.930 --> 00:55:54.089 A1CE Lecture 2: when… when we… when I apply for AWS account, I have to provide my email, and I create a password, and I validate my credit card, right? So, I can log into AWS Environment using my AWS account producer, which is… 280 00:55:54.340 --> 00:56:05.789 A1CE Lecture 2: is something like Super User. You can do everything, by using AWS account user. It's just like, you, when you authenticate. 281 00:56:06.540 --> 00:56:13.360 A1CE Lecture 2: the… authorization is… you can do everything, right? There's no policy… 282 00:56:13.520 --> 00:56:21.079 A1CE Lecture 2: mapping with AWS account reducer, but it's actually a policy, right? But policy that 283 00:56:21.080 --> 00:56:38.560 A1CE Lecture 2: you can do everything, right? You are the, just like, the god in this, AWS account, because you are a load user, right? So, for AWS recommendation, you need to use, AWS account load user. 284 00:56:38.590 --> 00:56:51.380 A1CE Lecture 2: only when it is required, right? You don't want to use ADB as a cow reducer to do anything. Do everything, every day, right? Because, because 285 00:56:51.800 --> 00:56:58.079 A1CE Lecture 2: It… it's just, like, super user, it can do anything, but if it's compromised. 286 00:56:58.190 --> 00:57:00.509 A1CE Lecture 2: It's gonna be, various… 287 00:57:00.610 --> 00:57:17.559 A1CE Lecture 2: serious problem, right? Because it's just like, you… you provide the key to the hacker, and if you… the hacker can get your credential of your AWS account reducer, they can do everything, right? They can chain permission, they can… 288 00:57:17.660 --> 00:57:23.930 A1CE Lecture 2: even close the account, right? It's… it's very, 289 00:57:24.490 --> 00:57:31.729 A1CE Lecture 2: But it's one of the identity that you can use in AWS, right? AWS account reducer, but use it 290 00:57:32.600 --> 00:57:37.700 A1CE Lecture 2: when it is required, right? Only. Normally, for day-to-day operation. 291 00:57:37.860 --> 00:57:50.559 A1CE Lecture 2: just create IAM user and SI Policy as the admin to that IAM user, and using that for day-to-day operation, instead of using AWS account root user, right? 292 00:57:51.000 --> 00:57:53.960 A1CE Lecture 2: And the last one, right? 293 00:57:54.220 --> 00:58:02.650 A1CE Lecture 2: Further reducer, AWS account, reducer, and the last one is AWS, Service. 294 00:58:03.080 --> 00:58:09.309 A1CE Lecture 2: Right? You may think, why AWS service is also identity in AWS? 295 00:58:10.880 --> 00:58:17.020 A1CE Lecture 2: I just go back to this, right? So, if you have… 296 00:58:17.230 --> 00:58:29.639 A1CE Lecture 2: storage, right? S3 bucket, and you have virtual machine, right? And you want to read the data that you keep in this storage, and download that 297 00:58:29.960 --> 00:58:32.189 A1CE Lecture 2: Data to this virtual machine. 298 00:58:32.300 --> 00:58:39.120 A1CE Lecture 2: You cannot… connect from VM to the storage directly? 299 00:58:39.260 --> 00:58:43.859 A1CE Lecture 2: The VM service in AWS Core, 300 00:58:44.190 --> 00:58:46.519 A1CE Lecture 2: I just used the correct name, right? 301 00:58:46.770 --> 00:58:57.349 A1CE Lecture 2: But virtual machine service in the West is called EC2, right? So, if you want to download the file from storage, it's 3 buckets to the EC2 instance. 302 00:58:58.210 --> 00:59:04.520 A1CE Lecture 2: Easy tool must be able to… must authenticate. 303 00:59:04.660 --> 00:59:13.439 A1CE Lecture 2: to the AWS API first. And if they successfully authenticated, It will get the… 304 00:59:13.660 --> 00:59:21.549 A1CE Lecture 2: the authorization to be able to download the file form, the S3 bucket, right? So. 305 00:59:22.030 --> 00:59:31.999 A1CE Lecture 2: EC2 or AWS service must authenticate and authorized with AWS API. So, AWS service. 306 00:59:32.710 --> 00:59:36.450 A1CE Lecture 2: can be… One of identity. 307 00:59:36.620 --> 00:59:48.530 A1CE Lecture 2: that can, using all requests to AWS API. So, for AWS environment, these are 6 308 00:59:49.690 --> 00:59:58.849 A1CE Lecture 2: identity that you can use to work with AWS environment, right? So, what is mean? 309 00:59:59.300 --> 01:00:03.169 A1CE Lecture 2: Here is, if you don't want to set up another domain. 310 01:00:03.440 --> 01:00:12.629 A1CE Lecture 2: Yeah, what you can use is, you can use IAM user, you can use IAM role, you can use AWS account root user, or 311 01:00:12.880 --> 01:00:28.710 A1CE Lecture 2: you are AWS service in your account, and want to access another AWS service that's also in your account, right? So, these are only, options for identity in AWS environment, right? 312 01:00:28.830 --> 01:00:29.760 A1CE Lecture 2: But… 313 01:00:33.800 --> 01:00:40.779 A1CE Lecture 2: One of the identity, cannot send requests to AWS API. Is… 314 01:00:43.980 --> 01:00:46.119 A1CE Lecture 2: I am user group. 315 01:00:46.380 --> 01:00:47.100 A1CE Lecture 2: Bye. 316 01:00:48.350 --> 01:00:58.940 A1CE Lecture 2: This one is, cannot send requests to the AWS API. Its core is not principle. 317 01:00:59.280 --> 01:01:00.120 A1CE Lecture 2: Bye. 318 01:01:00.260 --> 01:01:08.719 A1CE Lecture 2: All other identity is principle in AWS, right? I have to say that what is principle? 319 01:01:09.560 --> 01:01:18.570 A1CE Lecture 2: Principle in AWS is identity, That. Can… Sen? 320 01:01:19.090 --> 01:01:26.959 A1CE Lecture 2: request, to AWS API, right? So… 321 01:01:28.470 --> 01:01:32.389 A1CE Lecture 2: There are 6 identities that it will support. 322 01:01:32.490 --> 01:01:51.070 A1CE Lecture 2: Only one identity that is not principal is IAM user group. So, you can use IAM user, you can use IAM role, you can use federate User, you can use AWS account route user, or you are AWS service, right? All of these five identities 323 01:01:51.390 --> 01:01:59.309 A1CE Lecture 2: are principle, right? So, it is the identity that can send requests to AWS API. 324 01:01:59.680 --> 01:02:10.730 A1CE Lecture 2: And for the definition of principle, you also will see this in Google Cloud, and Google Cloud also said that this is principle. 325 01:02:11.060 --> 01:02:22.839 A1CE Lecture 2: And the meaning is the same, right? So, principle in Google Cloud and principle in AWS meaning the same thing. It's mean identity that can send requests to AWS API. 326 01:02:22.990 --> 01:02:24.520 A1CE Lecture 2: Same, right? 327 01:02:24.750 --> 01:02:30.050 A1CE Lecture 2: And I think for Google Cloud is also the same. 328 01:02:31.090 --> 01:02:37.099 A1CE Lecture 2: There are multiple types of identity that you can use in Google Cloud, but the name 329 01:02:37.980 --> 01:02:46.959 A1CE Lecture 2: it's gonna be a little bit different, right, for Google Cloud, and if some of you used Google Cloud before, you may think, hmm. 330 01:02:47.160 --> 01:02:49.079 A1CE Lecture 2: I am Ro. 331 01:02:49.280 --> 01:02:54.369 A1CE Lecture 2: Right? IAM role in AWS is identity, right? But… 332 01:02:55.040 --> 01:02:59.070 A1CE Lecture 2: I am Ro, if you used Google Cloud before. I am Ro. 333 01:02:59.450 --> 01:03:08.880 A1CE Lecture 2: in GCP, equal to… I am… policy in AWS. 334 01:03:10.130 --> 01:03:21.299 A1CE Lecture 2: So, this is something that, if you work with two cloud providers, this one is the first thing that you will be a little bit confused, because 335 01:03:21.500 --> 01:03:23.570 A1CE Lecture 2: It is the same name. 336 01:03:23.790 --> 01:03:26.740 A1CE Lecture 2: But the meaning is differenti. 337 01:03:26.890 --> 01:03:29.680 A1CE Lecture 2: Right? So, for AWS, 338 01:03:30.050 --> 01:03:44.199 A1CE Lecture 2: IM role is identity, right? And if you remember, I said about long-term and short-term, right? If you want to use long-term, right? Long-term identity. 339 01:03:44.400 --> 01:03:46.740 A1CE Lecture 2: IAM user is long-term. 340 01:03:48.850 --> 01:03:50.749 A1CE Lecture 2: It's long-term identity. 341 01:03:50.890 --> 01:03:59.080 A1CE Lecture 2: And, for sure, if IAM user is long-term, IAM low is for short-term. 342 01:03:59.740 --> 01:04:00.820 A1CE Lecture 2: Identity. 343 01:04:02.240 --> 01:04:02.940 A1CE Lecture 2: Bye. 344 01:04:03.650 --> 01:04:14.209 A1CE Lecture 2: So, AWS identity for different type of users. IAM user, long-term, right? IAM role, short-term, right? 345 01:04:14.360 --> 01:04:18.520 A1CE Lecture 2: And… for AWS service. 346 01:04:19.490 --> 01:04:27.679 A1CE Lecture 2: Right? So… I say that AWS service is identity that can 347 01:04:27.700 --> 01:04:41.650 A1CE Lecture 2: access that can send requests to the AWS API, to grant the access to another AWS service. And EC2 is, or any AWS resource, normally. 348 01:04:41.660 --> 01:04:51.410 A1CE Lecture 2: you have to assume, right, how easy you can authenticate with AWS API is assume 349 01:04:51.800 --> 01:04:56.939 A1CE Lecture 2: role, right? So, when AWS service wants to… 350 01:04:59.880 --> 01:05:10.320 A1CE Lecture 2: connect or access another AWS service, you have to create IAM role, right? IAM role will attach with IAM policy, right? 351 01:05:10.480 --> 01:05:18.999 A1CE Lecture 2: And… to assume role, it means when EC2 want to access S3 bucket? 352 01:05:19.330 --> 01:05:20.890 A1CE Lecture 2: Easy to view. 353 01:05:21.340 --> 01:05:30.020 A1CE Lecture 2: send requests to AWS API and tell AWS API that I am attached with this IAM role. 354 01:05:30.570 --> 01:05:37.540 A1CE Lecture 2: So… API will check, okay, and the policy that's attached to this 355 01:05:37.690 --> 01:05:48.240 A1CE Lecture 2: IAM rule allowed to exit S3 or not. If it allows, it will say, okay, you can exit S3. And… 356 01:05:48.750 --> 01:06:00.710 A1CE Lecture 2: EC2 can download or upload file to the S3 bucket, right? But if the EC2 want to access S3 again for the second time. 357 01:06:00.890 --> 01:06:13.779 A1CE Lecture 2: it has to authenticate again, because EC2 using IAM role to authenticate and authorize with AWS API? And IAM role is 358 01:06:14.050 --> 01:06:15.340 A1CE Lecture 2: Temporary. 359 01:06:16.400 --> 01:06:33.430 A1CE Lecture 2: or short-term identity. So, any time that EC2 want to access S3, it has to authenticate with AWS API every time, right? Because it is short-term identity. 360 01:06:33.620 --> 01:06:38.259 A1CE Lecture 2: And it's only per request, right? So you… 361 01:06:39.250 --> 01:06:43.870 A1CE Lecture 2: what we gonna get from this? Because we can chain policy. 362 01:06:43.990 --> 01:06:54.630 A1CE Lecture 2: to this IAM role anytime that you want. This time, EC2 may be able to access S3, but the next day, you will say that, oh, is it this easy to… 363 01:06:54.710 --> 01:07:12.769 A1CE Lecture 2: don't need to exit S3. We can change the policy, and even EC2 is using the same role, but when we change policy, EC2 can… may not be able to exit S3 in the next day or in the next month, because 364 01:07:12.770 --> 01:07:17.840 A1CE Lecture 2: policy is chained, right? So… This is why, short-term. 365 01:07:18.010 --> 01:07:34.299 A1CE Lecture 2: identity is more secure, right? Because when you authenticate, you authenticate for this time, right? Next time, you have to authenticate again, and make sure that, if we still have access or not, it's validated. 366 01:07:34.490 --> 01:07:42.750 A1CE Lecture 2: every time that we send the request to AWS API, right? So it's more secure, because you validate the 367 01:07:43.000 --> 01:07:48.799 A1CE Lecture 2: Authentication and authorization anytime that you make a request, right? 368 01:07:50.080 --> 01:07:57.679 A1CE Lecture 2: Okay, and… I think we cover most of… 369 01:07:58.080 --> 01:08:06.030 A1CE Lecture 2: the important part of identity, right? So… Just… 370 01:08:06.490 --> 01:08:09.399 A1CE Lecture 2: recap a little bit. I am user. 371 01:08:11.090 --> 01:08:15.040 A1CE Lecture 2: is long-term, right? This is long-term. 372 01:08:17.790 --> 01:08:25.850 A1CE Lecture 2: identity. So, it mapped with Long-term kidney chill, right? 373 01:08:26.050 --> 01:08:31.129 A1CE Lecture 2: So, IAM user is long-term identity. There are two types 374 01:08:32.220 --> 01:08:37.240 A1CE Lecture 2: Of long-term credential that you can create. 375 01:08:38.000 --> 01:08:45.960 A1CE Lecture 2: with… I am user, right? Two types of long-term credential. One is password. 376 01:08:46.779 --> 01:08:52.879 A1CE Lecture 2: Right? And second one is… programmatic access. 377 01:08:56.920 --> 01:08:57.600 A1CE Lecture 2: Alright. 378 01:08:58.439 --> 01:09:03.450 A1CE Lecture 2: Both password and programmatic access are long-term, so… 379 01:09:03.870 --> 01:09:07.620 A1CE Lecture 2: We have to make sure that Neat. 380 01:09:08.660 --> 01:09:11.410 A1CE Lecture 2: 2… Ensure. 381 01:09:12.569 --> 01:09:19.319 A1CE Lecture 2: Dad… it… not… compromise. 382 01:09:20.080 --> 01:09:22.410 A1CE Lecture 2: Right? Because it is long-term. 383 01:09:22.580 --> 01:09:32.769 A1CE Lecture 2: It will be… able to… you will be able to use this long-term credential as long as it's active. 384 01:09:33.260 --> 01:09:43.620 A1CE Lecture 2: in your environment, right? So, this is quite important. So that's why I think, you may… know about… 385 01:09:44.140 --> 01:09:50.030 A1CE Lecture 2: How we can ensure that the long-term credential is not compromised. 386 01:09:51.229 --> 01:09:57.800 A1CE Lecture 2: very well known, or the approach that we use to is 387 01:09:58.100 --> 01:10:02.000 A1CE Lecture 2: Changing the password every specific period of time. 388 01:10:02.260 --> 01:10:09.240 A1CE Lecture 2: 3 months, 6 months, or shared password every 1 year, at least you have to load it. 389 01:10:09.370 --> 01:10:14.649 A1CE Lecture 2: the password, right? Because we want to ensure that if it compromised. 390 01:10:15.000 --> 01:10:19.449 A1CE Lecture 2: It will not have really significant, 391 01:10:20.250 --> 01:10:32.490 A1CE Lecture 2: affect to… or create the potential problem to our environment. So, make sure that we rotate the credential every specific period of time, right? 392 01:10:32.650 --> 01:10:44.449 A1CE Lecture 2: But… Okay, so… just… We will go back to this, but, 393 01:10:45.730 --> 01:10:53.670 A1CE Lecture 2: So, okay, we already talked about authentication and authorization. Is… the AWS service, right? 394 01:10:54.080 --> 01:10:57.700 A1CE Lecture 2: So, we talk about IAM user, right? 395 01:10:59.080 --> 01:11:02.759 A1CE Lecture 2: And… Okay, this is the… 396 01:11:03.080 --> 01:11:15.810 A1CE Lecture 2: credential for IAM user. So, there are two types of long-term credential, username and password. This is the first one. And programmatic access is, 397 01:11:16.200 --> 01:11:18.979 A1CE Lecture 2: I'm not sure that we have the example. 398 01:11:19.520 --> 01:11:20.470 A1CE Lecture 2: No. 399 01:11:20.850 --> 01:11:33.560 A1CE Lecture 2: Okay, so… For programmatic access, it's called the key pair, the pair of AWS, access key, And… 400 01:11:34.330 --> 01:11:36.079 A1CE Lecture 2: Secret access key. 401 01:11:36.190 --> 01:11:36.880 A1CE Lecture 2: Right. 402 01:11:40.120 --> 01:11:55.979 A1CE Lecture 2: AWS XT and AWS CKXT, right? Access key is just like key ID, right? And the key, the private key, is CKX8 key, right? Key content, right? 403 01:11:59.220 --> 01:12:16.269 A1CE Lecture 2: I'm… I have experience to handle both of… I create IAM user, and one IAM user, you can assign both type of credential for one user, right? One IAM user can have 404 01:12:16.420 --> 01:12:20.899 A1CE Lecture 2: 1AM, I am user 1, you can have password. 405 01:12:21.070 --> 01:12:26.239 A1CE Lecture 2: Right? And you also can have programmatic access. 406 01:12:27.340 --> 01:12:28.100 A1CE Lecture 2: Right? 407 01:12:28.680 --> 01:12:35.690 A1CE Lecture 2: you can use both, right? Because it's credential that you can use. And also, It also support. 408 01:12:36.520 --> 01:12:56.149 A1CE Lecture 2: multi-factor authentication, right? You can… by default, it's optional, you don't have… by default, it's disabled, but if you want more secure, level of access, right, you can enable multi-factor authentication for 409 01:12:56.160 --> 01:13:00.329 A1CE Lecture 2: each IAM user, or… 410 01:13:00.390 --> 01:13:09.440 A1CE Lecture 2: I am role, if you want. I am role, I'm not sure, but I am user, I'm sure that each I am user, you can assign 411 01:13:09.600 --> 01:13:23.249 A1CE Lecture 2: all this, right? IAM user can have a password, right? IAM user can have programmatic access, and IAM user can set up or enable multi-factor authentication, right? 412 01:13:23.250 --> 01:13:38.330 A1CE Lecture 2: So, it's just the second credential that you have to provide. At least, you have to provide credential either password or programmatic access. But if you have MFA, this means if you only… if you have 413 01:13:38.330 --> 01:13:47.840 A1CE Lecture 2: correct password, or if you have correct programmatic access, you still have to provide a code for multi-factor authenticator, right? 414 01:13:47.890 --> 01:13:52.720 A1CE Lecture 2: In order to successfully authenticate and authorize, right? 415 01:13:53.010 --> 01:14:03.310 A1CE Lecture 2: But… the credential that I found that easy to compromise based on my experience. 416 01:14:05.110 --> 01:14:11.249 A1CE Lecture 2: This one, programmatic access, right? Because, some people will store… 417 01:14:11.790 --> 01:14:31.470 A1CE Lecture 2: But I think right now, it's gonna be less, because people have enough experience, because in the past, I think past 5… 5 years ago, programmatic access is just, like, some people just upload the code into public people, such as GitHub. 418 01:14:31.830 --> 01:14:38.449 A1CE Lecture 2: And it contains XH key and sec key inside the code. 419 01:14:38.580 --> 01:14:43.499 A1CE Lecture 2: And the hacker will have a bot to crawl, right? And… 420 01:14:43.830 --> 01:14:46.899 A1CE Lecture 2: It's really easy to compromise, and… 421 01:14:47.040 --> 01:14:49.489 A1CE Lecture 2: From my experience editing, every year. 422 01:14:49.860 --> 01:14:59.370 A1CE Lecture 2: If I provide programmatic access, for about 20 or 40 users, At least… One. 423 01:15:00.230 --> 01:15:04.709 A1CE Lecture 2: One cadence here will be compromised. It's programmatic access. 424 01:15:04.910 --> 01:15:05.900 A1CE Lecture 2: Password. 425 01:15:06.300 --> 01:15:19.540 A1CE Lecture 2: I never have experience from the password compromise at all, right? For 5 years, no password compromise, right? But programmatic access is just, like, every year. 426 01:15:19.710 --> 01:15:28.190 A1CE Lecture 2: Until now. Even, I say it every time that make sure that you… Protect this programmatic access. 427 01:15:30.510 --> 01:15:35.390 A1CE Lecture 2: And do it. Important, and I just say that please do not 428 01:15:35.600 --> 01:15:46.360 A1CE Lecture 2: leak, or make any risks to leak this credential, because it's important. I just only can reduce the number of compromise. 429 01:15:46.620 --> 01:15:49.630 A1CE Lecture 2: That happens each year. But… never. 430 01:15:49.770 --> 01:15:58.859 A1CE Lecture 2: never, it's… it never disappeared. It just, like, happened every time. So, 431 01:15:59.250 --> 01:16:14.920 A1CE Lecture 2: when people, want programmatic access for me, right, I just have to just, like, I have to talk, right? What you want to do, what you want to use, and I have to write a policy that is quite specific. 432 01:16:15.100 --> 01:16:22.950 A1CE Lecture 2: I want to make sure that, policy for programmatic access is very… or… 433 01:16:23.070 --> 01:16:28.040 A1CE Lecture 2: policy for IAM user that has programmedity access. 434 01:16:28.320 --> 01:16:30.189 A1CE Lecture 2: Right? So… 435 01:16:30.860 --> 01:16:49.520 A1CE Lecture 2: for my solution, right? This is my… my experience, right? It may not apply to some use case, but this is what I do, when I work with, even. For example, I have… I am user for Group 1. 436 01:16:49.810 --> 01:16:57.179 A1CE Lecture 2: Right? I… if Group 1 is maybe, dev, right? Dev team, right? 437 01:16:58.040 --> 01:17:12.249 A1CE Lecture 2: If this is IAM user for human, I will say that, okay, this is IAM user, and this is, policy for IAM user, policy one, but if dev team need programmatic access. 438 01:17:13.400 --> 01:17:15.259 A1CE Lecture 2: I will create. 439 01:17:16.000 --> 01:17:18.770 A1CE Lecture 2: Another… IAM user. 440 01:17:20.970 --> 01:17:21.970 A1CE Lecture 2: Excuse me? 441 01:17:22.310 --> 01:17:23.780 A1CE Lecture 2: I separate. 442 01:17:24.660 --> 01:17:26.810 A1CE Lecture 2: identity for… 443 01:17:27.400 --> 01:17:40.320 A1CE Lecture 2: password, and I have separate identity, even if it's for the same team, right? The same team, but I will create policy 2, right, for 444 01:17:40.570 --> 01:17:51.990 A1CE Lecture 2: programmatic access only, right? Because… One thing is because I… this policy is… More strict, right? 445 01:17:52.120 --> 01:18:02.570 A1CE Lecture 2: Because, why? Why I come up with this solution at the end? Right, because I cannot… 446 01:18:02.810 --> 01:18:11.309 A1CE Lecture 2: Ensure that… compromise of programmatic access will not happen, right? It will happen. 447 01:18:11.600 --> 01:18:19.419 A1CE Lecture 2: So, I have to change my mind after 2 years, right? First 2 years, I try to make sure that I… 448 01:18:20.050 --> 01:18:27.310 A1CE Lecture 2: can decrease the compromise for programmatic access to zero. I tried that for 2 years, and I just… 449 01:18:28.130 --> 01:18:38.199 A1CE Lecture 2: reached the conclusion that I cannot do that, right? If I cannot do that, but I have still need to provide the program with the access, I separate. 450 01:18:38.330 --> 01:18:50.979 A1CE Lecture 2: Right? One is for human, one is for programmatic access. I also make the policy more strict, and sometimes it's just like, what I use is log 451 01:18:51.120 --> 01:18:53.320 A1CE Lecture 2: 2… 1 region. 452 01:18:54.390 --> 01:18:59.450 A1CE Lecture 2: Right? It's just that if you can create VM, if… 453 01:18:59.590 --> 01:19:13.060 A1CE Lecture 2: If you are human, and you use this policy one, you can create in any region, it's okay, right? But if this is for programmatic access, I would say that you can use 454 01:19:13.200 --> 01:19:20.629 A1CE Lecture 2: only in… Thailand region, or you can use in Singapore region, right? Because if it's compromised. 455 01:19:21.830 --> 01:19:23.710 A1CE Lecture 2: Hacker will use this 456 01:19:23.890 --> 01:19:39.310 A1CE Lecture 2: programmatic access to create resource only within one region, and it's better, right? It's just, like, control the blast area, right? If it's compromised, user can do with one region, and it 457 01:19:39.330 --> 01:19:46.680 A1CE Lecture 2: easy to, to detect and contain the problem, right? So that is what I do, right? But… 458 01:19:47.810 --> 01:19:59.289 A1CE Lecture 2: you have one more identity to work with anytime, right? If you have 5 teams, it means you maintain 10 identities for all the team, but for me, it's… 459 01:19:59.480 --> 01:20:06.289 A1CE Lecture 2: the way I… I think I'm comfortable, and I think it's the better one. And also, when… 460 01:20:06.530 --> 01:20:10.339 A1CE Lecture 2: I also can't know, because if this 461 01:20:10.670 --> 01:20:14.590 A1CE Lecture 2: Credential for programmatic access is leaked. 462 01:20:14.900 --> 01:20:21.760 A1CE Lecture 2: I can check with the user activity that, okay, just only look for 463 01:20:22.960 --> 01:20:35.170 A1CE Lecture 2: this username, right? What action from this username do in AWS environment? So, I can check, because if I have one username, and 464 01:20:35.450 --> 01:20:41.500 A1CE Lecture 2: I have programmatic access, password, and multi-factor authentication to one user. 465 01:20:41.800 --> 01:20:48.300 A1CE Lecture 2: I will not know whether this requires using programmatic access, or this 466 01:20:48.600 --> 01:20:53.530 A1CE Lecture 2: access using password. So, separate into two identity. 467 01:20:53.710 --> 01:20:57.369 A1CE Lecture 2: Easy to troubleshoot the problem, right? 468 01:20:57.690 --> 01:21:04.569 A1CE Lecture 2: So that's, that's why is the reason I'm using this, configuration, right? 469 01:21:05.770 --> 01:21:10.270 A1CE Lecture 2: Okay, so this is, IAM user. 470 01:21:10.440 --> 01:21:13.999 A1CE Lecture 2: So, for IAM role, right? 471 01:21:14.440 --> 01:21:26.090 A1CE Lecture 2: For IAM role, you don't have credential, right? But it will generate from, generate, token? 472 01:21:26.200 --> 01:21:28.400 A1CE Lecture 2: Right? Temporary token? 473 01:21:29.590 --> 01:21:30.430 A1CE Lecture 2: Right? 474 01:21:30.660 --> 01:21:43.750 A1CE Lecture 2: From the backend service in AWS called AWS STS, right? Security… token session. 475 01:21:45.190 --> 01:21:47.149 A1CE Lecture 2: I'm not sure, I'll have to check, but… 476 01:21:47.270 --> 01:22:01.389 A1CE Lecture 2: there's the service in AWS that, if you create IAM role, it will be in the IAM, right? So if the AWS service or any identity try to assume role, 477 01:22:01.460 --> 01:22:11.460 A1CE Lecture 2: it will check that, okay, is this role is allowed to be used, right? And if the role is allowed to be used. 478 01:22:11.610 --> 01:22:28.209 A1CE Lecture 2: AWS STS will create temporary token back to the client, and the client can use that token to access the AWS resource, right? And it's temporary, it means it have 479 01:22:29.370 --> 01:22:33.810 A1CE Lecture 2: You can set time limit, right? 480 01:22:34.850 --> 01:22:36.169 A1CE Lecture 2: For the token. 481 01:22:39.590 --> 01:22:41.710 A1CE Lecture 2: Right? It can be the… the… 482 01:22:42.220 --> 01:22:47.559 A1CE Lecture 2: The token can be used within limited period of time. 483 01:22:47.960 --> 01:22:56.920 A1CE Lecture 2: Currently, the default, if you not specify, if you create an role, and you not specify that 484 01:22:57.140 --> 01:23:00.729 A1CE Lecture 2: How long that this role can be used. 485 01:23:00.860 --> 01:23:05.280 A1CE Lecture 2: Default… time limit. 486 01:23:06.790 --> 01:23:08.570 A1CE Lecture 2: And I have to stray it. 487 01:23:08.920 --> 01:23:16.380 A1CE Lecture 2: That is the default time limit for now, is… 12 hours. 488 01:23:16.630 --> 01:23:23.349 A1CE Lecture 2: by default, right? So, when you use IAM role, you can specify I think… 489 01:23:23.720 --> 01:23:28.480 A1CE Lecture 2: The shortest, time limit is 1 minute. 490 01:23:28.880 --> 01:23:37.949 A1CE Lecture 2: Right? One minute is the shortest, if I… if I remember correctly. But the default value is 12 hours, right? So… 491 01:23:38.290 --> 01:23:44.379 A1CE Lecture 2: even you not config anything, and you're using IAM role, you can access for 12 hours. 492 01:23:45.630 --> 01:23:51.829 A1CE Lecture 2: But, 2 years ago, The default value is 8 hours. 493 01:23:52.380 --> 01:24:01.769 A1CE Lecture 2: 3 years ago, the default value is 4 out. That's… that's why I said that it's the default value for now, because 494 01:24:01.870 --> 01:24:18.659 A1CE Lecture 2: In previous 3 years, it changed 2 times, right? So, make sure that, you check with the AWS document, right? What is the default value? So, for me, as the system and network engineer. 495 01:24:18.700 --> 01:24:26.900 A1CE Lecture 2: Normally, I don't like default value, right? If I want to use for temporary access, I want to specify. 496 01:24:27.220 --> 01:24:30.879 A1CE Lecture 2: how long it gonna take, right? But… 497 01:24:31.410 --> 01:24:46.129 A1CE Lecture 2: I think this can be said by, Can only… Set using… command line interface, or SDK. 498 01:24:46.360 --> 01:24:56.360 A1CE Lecture 2: It means you cannot config the TAM if you use management console, but 499 01:24:56.490 --> 01:25:13.739 A1CE Lecture 2: This is also another thing that it may change, right? But normally, when I try to… to set the time limit for IAM role, normally I create IAM role by using command line interface, or using software development kit, but 500 01:25:14.190 --> 01:25:21.160 A1CE Lecture 2: For myself, yes, I'm not a software engineer, so normally, I will use command line interface. 501 01:25:21.570 --> 01:25:30.849 A1CE Lecture 2: the most, right? SDK, I'm using a little, when I'm teaching about, software development in 502 01:25:31.570 --> 01:25:43.199 A1CE Lecture 2: In some course, but normally, okay, I will use CLI, but I never use Management Console if I want to set default time limit. 503 01:25:43.680 --> 01:25:59.849 A1CE Lecture 2: But I think Management Console may be updates, right? Because I think this year, from my experience, if you use AWS for a long time, this year, you will notice that a lot of things is changing and updated in management console. 504 01:26:01.120 --> 01:26:13.430 A1CE Lecture 2: Okay, so this is IAM role, this is for temporary access, and you don't have to specify any type of, credential, right? Because, 505 01:26:13.900 --> 01:26:19.040 A1CE Lecture 2: only IAM user, that you can specify credential, right? 506 01:26:19.310 --> 01:26:33.540 A1CE Lecture 2: For IAM role, it's temporary, and it's using a short-term token that's generated from AWS STS, right? You don't have to config, it's just the back-end thing that AWS do that for you. 507 01:26:35.440 --> 01:26:37.230 A1CE Lecture 2: Okay, 508 01:26:40.890 --> 01:26:46.589 A1CE Lecture 2: Let me check what I have still done cover. 509 01:26:47.220 --> 01:27:02.529 A1CE Lecture 2: For identity, I think we covered everything. Oh, I am user, I am role. And I am user group. This… normally in the past, it's called I am group, but I am user group. 510 01:27:03.040 --> 01:27:06.130 A1CE Lecture 2: is for… diminished. 511 01:27:07.280 --> 01:27:09.390 A1CE Lecture 2: Okay, I… I ride. 512 01:27:10.650 --> 01:27:14.600 A1CE Lecture 2: for IAM user group. 513 01:27:15.870 --> 01:27:18.390 A1CE Lecture 2: is for managed. 514 01:27:20.440 --> 01:27:30.410 A1CE Lecture 2: Policy… In… in environment. 515 01:27:34.030 --> 01:27:43.160 A1CE Lecture 2: that… We have… Lars… Number… of… 516 01:27:43.400 --> 01:27:51.309 A1CE Lecture 2: user, right? So, based on the name, I think you may know, right? We can create I am… 517 01:27:51.820 --> 01:27:54.160 A1CE Lecture 2: user… group. 518 01:27:55.180 --> 01:27:59.800 A1CE Lecture 2: depth, Right? And we can create. 519 01:28:00.280 --> 01:28:06.150 A1CE Lecture 2: I am… User… group… Production. 520 01:28:06.590 --> 01:28:08.649 A1CE Lecture 2: And you can attach. 521 01:28:10.140 --> 01:28:20.400 A1CE Lecture 2: User A, or user B, and user C, and user D. And when you attach policy, right, because if you are dead. 522 01:28:20.640 --> 01:28:23.819 A1CE Lecture 2: team, and if IUR production team. 523 01:28:23.920 --> 01:28:26.380 A1CE Lecture 2: You may need to… 524 01:28:26.580 --> 01:28:40.359 A1CE Lecture 2: a different set of policy, right? So this is policy 1, this is policy 3, right? And for depth, you may need Policy 1, and you may need Policy 2. 525 01:28:40.480 --> 01:28:52.359 A1CE Lecture 2: Right? So, you don't have to connect policy directly to each identity, right? Because if you are in the same team, right, you just 526 01:28:52.470 --> 01:29:05.220 A1CE Lecture 2: become member of IAM user group, the same IAM user group. So, if you're a dev team, you become a member of IAM user group DEP, 527 01:29:05.540 --> 01:29:17.940 A1CE Lecture 2: And you attach the policy for the dev team directly to the user group, right? And user that the member of that user group will inherit. 528 01:29:18.570 --> 01:29:33.070 A1CE Lecture 2: Policy 1 and Policy 2 from the user group, right? To make sure that if one day you have to update the policy, right? So, this dev team may use… need policy 4. 529 01:29:33.670 --> 01:29:38.639 A1CE Lecture 2: it will… Inherit automatically from 530 01:29:39.250 --> 01:29:54.790 A1CE Lecture 2: IAM user group to all the user that is the member of the same user group. So, we make sure that the policy for each user will be consistent, even you update, right? 531 01:29:55.520 --> 01:30:15.469 A1CE Lecture 2: So, this is the… the main use case of IAM user group, is to group users that have the same type of policy, and we can manage the consistency implementation of policy for each specific group, right? So, we use IAM user group. 532 01:30:17.480 --> 01:30:23.530 A1CE Lecture 2: Okay, so we addressed I am user, I am group, and I am role. 533 01:30:23.660 --> 01:30:30.340 A1CE Lecture 2: Right? The last thing that we need to talk about is policy, right? 534 01:30:31.160 --> 01:30:33.859 A1CE Lecture 2: For policy, 535 01:30:36.360 --> 01:30:47.910 A1CE Lecture 2: One important thing that I need everyone to remember, this is what you have to use all the time, right? 536 01:30:48.640 --> 01:30:49.780 A1CE Lecture 2: What it is. 537 01:30:50.990 --> 01:30:52.920 A1CE Lecture 2: for IAM policy. 538 01:30:54.470 --> 01:30:58.820 A1CE Lecture 2: So, one thing, each… Identity? 539 01:31:01.350 --> 01:31:04.560 A1CE Lecture 2: must… Attached. 540 01:31:05.870 --> 01:31:09.460 A1CE Lecture 2: with… At least. 541 01:31:11.360 --> 01:31:14.630 A1CE Lecture 2: One, I am policy. 542 01:31:15.390 --> 01:31:22.520 A1CE Lecture 2: But… It can. 543 01:31:23.600 --> 01:31:24.580 A1CE Lecture 2: Attached. 544 01:31:25.970 --> 01:31:34.160 A1CE Lecture 2: up to… I think if the number's still the same, it's up to… 15 policy. 545 01:31:34.400 --> 01:31:41.959 A1CE Lecture 2: for one IAM user. For example, if you are user A, right, user A can attach with 546 01:31:42.260 --> 01:31:46.620 A1CE Lecture 2: two policy. Policy 1 and Policy 2, right? 547 01:31:46.760 --> 01:31:47.720 A1CE Lecture 2: And… 548 01:31:50.460 --> 01:32:08.319 A1CE Lecture 2: when you evaluate policy for each identity, it will evaluate or attach policy at the same time, right? So it may be possible that this may be happened. Policy 1 allows 549 01:32:08.890 --> 01:32:17.600 A1CE Lecture 2: action… X, Right? And policy to… Deny. 550 01:32:17.810 --> 01:32:18.930 A1CE Lecture 2: Action. 551 01:32:19.400 --> 01:32:20.230 A1CE Lecture 2: X. 552 01:32:20.910 --> 01:32:36.339 A1CE Lecture 2: So, when this user… send requests, to perform action X, 2… AWS API, right? 553 01:32:36.460 --> 01:32:41.070 A1CE Lecture 2: Aws API will, if they pass authentication. 554 01:32:41.240 --> 01:32:48.210 A1CE Lecture 2: If this is… user A is correct user, and when they try to authorize. 555 01:32:48.360 --> 01:32:55.819 A1CE Lecture 2: it has to check Policy 1 and Policy 2, right? But it will check all policy at the same time. 556 01:32:56.130 --> 01:33:08.580 A1CE Lecture 2: And it will be followed by this diagram, right? It evaluates all applicable policy. It means it evaluated policy 1 and 2 at the same time. 557 01:33:09.140 --> 01:33:13.000 A1CE Lecture 2: But what will be evaluated first? 558 01:33:14.900 --> 01:33:18.529 A1CE Lecture 2: what is explicit deny? So, what… 559 01:33:18.590 --> 01:33:26.030 A1CE Lecture 2: the policy that say deny, right? If there are denied, specify. 560 01:33:26.090 --> 01:33:40.449 A1CE Lecture 2: clearly in the policy, if it's yes, it's denied, right? So, what happens if user A requests to perform action X with the specific resource, right? 561 01:33:40.680 --> 01:33:51.009 A1CE Lecture 2: for authorization, it will check both policy, right, which one is said explicit deny for action X. In this case. 562 01:33:51.710 --> 01:33:55.549 A1CE Lecture 2: Yeah, it will be filed at Policy 2, 563 01:33:56.450 --> 01:34:01.110 A1CE Lecture 2: specify that deny action X, so the outcome is 564 01:34:02.440 --> 01:34:15.020 A1CE Lecture 2: deny, right? Deny, win, right? So, what the AWS API will respond back is, It's not allowed, right? 565 01:34:15.260 --> 01:34:16.020 A1CE Lecture 2: Fail. 566 01:34:16.670 --> 01:34:22.289 A1CE Lecture 2: Right? Because you're not allowed to perform this action X, because policy 2, 567 01:34:22.460 --> 01:34:29.289 A1CE Lecture 2: specify that you cannot perform action A with this resource, right? 568 01:34:29.990 --> 01:34:44.249 A1CE Lecture 2: And… but if there are no explicit deny, so we check explicit allow, is provided in the policy or not. If yes, allow, right? But if no, is 569 01:34:44.880 --> 01:34:55.480 A1CE Lecture 2: implicit deny, right? So, if the policy do not specify that is explicit deny or Explicit allow. 570 01:34:55.970 --> 01:35:02.340 A1CE Lecture 2: You can assume that the action Will be denied, because… 571 01:35:02.890 --> 01:35:15.360 A1CE Lecture 2: If there are no explicit deny, no explicit allow, it will be implicit deny, right? So this is how IAM policy works, right? 572 01:35:16.650 --> 01:35:23.870 A1CE Lecture 2: So, another thing, if you have policy, right, policy will have 573 01:35:24.000 --> 01:35:28.050 A1CE Lecture 2: statement, right? The statement of each policy. 574 01:35:28.190 --> 01:35:36.139 A1CE Lecture 2: You have Stedman, and you will have effect, right? Effect is, allow. 575 01:35:36.500 --> 01:35:44.570 A1CE Lecture 2: or deny, right? And it will have action, so it will just have resource. 576 01:35:45.790 --> 01:35:52.670 A1CE Lecture 2: and action that is possible. For example, EC2? 577 01:35:53.020 --> 01:36:01.970 A1CE Lecture 2: And if action is star, it means that white card Whitehart, is… 578 01:36:02.590 --> 01:36:07.100 A1CE Lecture 2: You can do anything. You can do… Anything. 579 01:36:07.680 --> 01:36:08.959 A1CE Lecture 2: If it's by cut. 580 01:36:09.240 --> 01:36:13.439 A1CE Lecture 2: And this is action, right? So you can do any action. 581 01:36:14.140 --> 01:36:22.480 A1CE Lecture 2: with the EC2 or Virtual Machine Resource, and effect, action, and… resource. 582 01:36:23.570 --> 01:36:24.280 A1CE Lecture 2: Right. 583 01:36:24.400 --> 01:36:35.379 A1CE Lecture 2: And what is resource, right? If this is EC2, it's meanVM, it's… you may specify that resource is EC2, 584 01:36:35.510 --> 01:36:50.510 A1CE Lecture 2: A, right? Or, it can be star, it means white card, any easy tool in your AWS environment is possible, right? So, this is, in each statement in the policy, you have to specify ethic. 585 01:36:50.930 --> 01:36:51.980 A1CE Lecture 2: Action. 586 01:36:52.140 --> 01:37:04.270 A1CE Lecture 2: resource, right? And the… the fourth syntax is condition, right? But condition is only… 587 01:37:04.610 --> 01:37:09.920 A1CE Lecture 2: only thing that is optional. It means you can specify a condition. 588 01:37:10.050 --> 01:37:21.390 A1CE Lecture 2: or you don't have to specify any condition. It will decide based on effect, action, and resource, right? So this is policy statement. 589 01:37:23.110 --> 01:37:26.280 A1CE Lecture 2: Okay. 590 01:37:26.550 --> 01:37:35.450 A1CE Lecture 2: So, look at the example. For any policy, you have to specify effect. 591 01:37:35.600 --> 01:37:43.729 A1CE Lecture 2: action, and resource, right? If you don't have condition, it's okay, right? It still works, right? 592 01:37:43.920 --> 01:37:45.349 A1CE Lecture 2: 4 version? 593 01:37:45.520 --> 01:37:53.239 A1CE Lecture 2: it using the same number, right? Right now, this is the version that we use. 2020… 2012? 594 01:37:53.880 --> 01:38:03.149 A1CE Lecture 2: 10, 17, right? You will not change. It will not change at this time, right? You have to specify effect, action, and resource. 595 01:38:03.880 --> 01:38:09.049 A1CE Lecture 2: I will look for condition, no condition. 596 01:38:10.330 --> 01:38:12.789 A1CE Lecture 2: Which one is… okay. 597 01:38:13.650 --> 01:38:20.640 A1CE Lecture 2: So, in some policy, it will have… condition. 598 01:38:21.420 --> 01:38:32.500 A1CE Lecture 2: Right? So, if the policy statement has condition, it means it will evaluate condition first, right? 599 01:38:32.810 --> 01:38:40.470 A1CE Lecture 2: it still not check effect, action, or resource yet. If, it will not check 600 01:38:40.630 --> 01:38:51.380 A1CE Lecture 2: effect, action, or resource yet, it will check condition first, right? If condition return true, Then, we check FA. 601 01:38:51.630 --> 01:38:53.579 A1CE Lecture 2: Action, and resource. 602 01:38:53.740 --> 01:38:54.470 A1CE Lecture 2: Right. 603 01:38:54.650 --> 01:38:59.480 A1CE Lecture 2: But if… The condition return balls. 604 01:39:01.220 --> 01:39:07.209 A1CE Lecture 2: the outcome is denied, right? So, if the condition is true. 605 01:39:07.470 --> 01:39:11.300 A1CE Lecture 2: We check what the policy specifies. 606 01:39:11.470 --> 01:39:15.410 A1CE Lecture 2: But if the condition returns false. 607 01:39:16.370 --> 01:39:22.110 A1CE Lecture 2: It will say that, okay, this action is denied without shaking effect. 608 01:39:22.240 --> 01:39:26.140 A1CE Lecture 2: action or resource, right? Because condition is fall. 609 01:39:28.430 --> 01:39:34.079 A1CE Lecture 2: Okay, and this is the example of IAM policy, 610 01:39:36.310 --> 01:39:44.170 A1CE Lecture 2: Okay, I think one of the last things that is important 611 01:39:45.360 --> 01:39:57.910 A1CE Lecture 2: Last thing that is important for this… But… I will give you as… as, 612 01:39:58.450 --> 01:40:00.860 A1CE Lecture 2: I, I will ask you, 613 01:40:01.220 --> 01:40:10.849 A1CE Lecture 2: the question in the Google Form, again. For this week, last week, we have, assignment in Google Form, right? 614 01:40:11.250 --> 01:40:17.289 A1CE Lecture 2: And I think for this week, I also will ask you to, 615 01:40:18.410 --> 01:40:21.750 A1CE Lecture 2: Sorry. I asked you to answer the Google Form. 616 01:40:21.860 --> 01:40:23.900 A1CE Lecture 2: And sorry, I have to shake. 617 01:40:24.260 --> 01:40:27.200 A1CE Lecture 2: Will there be the total weather induced? 618 01:40:29.960 --> 01:40:41.859 A1CE Lecture 2: IS admin form… Okay, okay, Matt, thank you. I will provide that, I will add… 619 01:40:42.710 --> 01:40:47.519 A1CE Lecture 2: That information that you asked, in the canvas, right? 620 01:40:47.940 --> 01:40:51.410 A1CE Lecture 2: But for last week, I'm not… 621 01:40:51.640 --> 01:40:54.849 A1CE Lecture 2: It, it just warns you… 622 01:40:55.090 --> 01:41:01.629 A1CE Lecture 2: just get the idea, because last week, it's just, introduction. So any… 623 01:41:01.700 --> 01:41:15.390 A1CE Lecture 2: I, I'm not looking for specific detail from your answer, I just, like, check what, what, what you understand from, the lecture that we discussed. But… 624 01:41:15.420 --> 01:41:18.839 A1CE Lecture 2: Okay, but for starting from this week. 625 01:41:18.870 --> 01:41:29.519 A1CE Lecture 2: yes, I… I will have, the Kite River, right? But I think, for me, I'm not about, I will have kite everywhere, but it's not… not for 626 01:41:29.520 --> 01:41:40.270 A1CE Lecture 2: fix, right? Because normally, if I want you to… to just write the answer, mostly I want… I want to just write the feedback. 627 01:41:40.340 --> 01:41:50.910 A1CE Lecture 2: about what you think about the question. So it's just like feedback that, okay, if I, 628 01:41:54.130 --> 01:42:06.060 A1CE Lecture 2: is there anything, that you not understand, or you correctly understand, or you not understand, or you're not really clear about some topic? So, I will use that, 629 01:42:06.890 --> 01:42:08.919 A1CE Lecture 2: That answer to just… 630 01:42:09.070 --> 01:42:21.540 A1CE Lecture 2: check what I can do, or what may be something that maybe I need to discuss a little bit more in detail in the next class or not, right? But okay, but I will provide that. 631 01:42:21.720 --> 01:42:27.170 A1CE Lecture 2: But for this week, for Google Form, because… 632 01:42:28.330 --> 01:42:40.700 A1CE Lecture 2: When you look at this, policy, right, it… it's quite… I will ask you that if… 633 01:42:41.000 --> 01:42:48.670 A1CE Lecture 2: if, if… But I will also say in the Google Form, if we don't have this. 634 01:42:48.770 --> 01:42:56.020 A1CE Lecture 2: I, I, I, I delete… These form the resource, form the policy. 635 01:42:57.740 --> 01:43:02.689 A1CE Lecture 2: Do you think the outcome's still the same, or different? 636 01:43:03.130 --> 01:43:03.840 A1CE Lecture 2: Right. 637 01:43:05.610 --> 01:43:16.140 A1CE Lecture 2: Because if you look… Briefly, Right? Is it quite… The same thing, right? 638 01:43:16.300 --> 01:43:25.489 A1CE Lecture 2: I think… Do you think that even we delete the… the… this part… 639 01:43:26.520 --> 01:43:36.830 A1CE Lecture 2: it's still the same, right? The outcome may be the same, but why? But why? The important is, there's two questions… two… two questions to answer. 640 01:43:37.070 --> 01:43:41.390 A1CE Lecture 2: For this is, If we remove this part. 641 01:43:42.110 --> 01:43:48.120 A1CE Lecture 2: is the result still the same, right? And if it's the same. 642 01:43:48.540 --> 01:43:50.939 A1CE Lecture 2: Why we need this statement. 643 01:43:51.870 --> 01:43:56.000 A1CE Lecture 2: That, that's what I, 644 01:43:56.170 --> 01:44:03.940 A1CE Lecture 2: want you to, research and answer, in the Google Form for, today, right? 645 01:44:04.940 --> 01:44:05.820 A1CE Lecture 2: Okay. 646 01:44:06.000 --> 01:44:07.680 A1CE Lecture 2: One more thing. 647 01:44:07.800 --> 01:44:18.360 A1CE Lecture 2: Because we're talking about the policy, that normally policy will have effect, action, resource, and condition. But in AWS, 648 01:44:19.580 --> 01:44:23.000 A1CE Lecture 2: In AWS, I am. 649 01:44:24.070 --> 01:44:29.600 A1CE Lecture 2: There's… 2… Type. 650 01:44:30.470 --> 01:44:33.529 A1CE Lecture 2: of IM policy. 651 01:44:34.860 --> 01:44:38.249 A1CE Lecture 2: The first one is identity-based. 652 01:44:40.690 --> 01:44:41.730 A1CE Lecture 2: Policy. 653 01:44:42.670 --> 01:44:45.739 A1CE Lecture 2: And the second one is resource-based. 654 01:44:51.030 --> 01:44:54.250 A1CE Lecture 2: But what is the difference? 655 01:44:54.420 --> 01:44:56.499 A1CE Lecture 2: It's based on the name, right? 656 01:44:56.680 --> 01:45:04.630 A1CE Lecture 2: Identity-based policy is the policy… policy… that… Attest. 657 01:45:06.020 --> 01:45:08.680 A1CE Lecture 2: with… Identity. 658 01:45:10.450 --> 01:45:18.420 A1CE Lecture 2: Right? And resource-based policy is Policy… that… Attached. 659 01:45:19.770 --> 01:45:27.430 A1CE Lecture 2: with… I highly… I… I have to highlight as… 660 01:45:28.090 --> 01:45:39.060 A1CE Lecture 2: Resource-based policy is policy that's attached with specific AWS, resources. 661 01:45:39.990 --> 01:45:48.000 A1CE Lecture 2: What specific mean is not every… AWS, Vsauce. 662 01:45:50.100 --> 01:45:50.960 A1CE Lecture 2: Support. 663 01:45:52.160 --> 01:46:00.810 A1CE Lecture 2: So, we can create policy, IAM policy, to attach with AWS resource that 664 01:46:01.060 --> 01:46:07.830 A1CE Lecture 2: support resource-based policy. Not every AWS service supports resource-based policy, right? 665 01:46:08.140 --> 01:46:15.519 A1CE Lecture 2: But identity-based policy is… You can use identity-based policy to attach with 666 01:46:16.660 --> 01:46:22.200 A1CE Lecture 2: or AWS identity. I am user, I am, bro. 667 01:46:22.470 --> 01:46:31.760 A1CE Lecture 2: and I am user group, right? You can attach identity-based policy with all type of identity that… that you have. 668 01:46:31.870 --> 01:46:32.530 A1CE Lecture 2: Bye. 669 01:46:33.670 --> 01:46:34.640 A1CE Lecture 2: But… 670 01:46:35.180 --> 01:46:47.020 A1CE Lecture 2: how we can tell, because the syntax of identity… identity-based policy and resource-based policy is quite… is really similar. The main difference is 671 01:46:47.290 --> 01:46:49.399 A1CE Lecture 2: For resource bankruptcy? 672 01:46:49.720 --> 01:46:55.610 A1CE Lecture 2: You have to specify Principal? 673 01:46:59.280 --> 01:47:00.620 A1CE Lecture 2: In the policy. 674 01:47:01.450 --> 01:47:02.120 A1CE Lecture 2: Right. 675 01:47:03.530 --> 01:47:08.790 A1CE Lecture 2: So, go back to have a loop, right? This is identity-based policy. 676 01:47:09.030 --> 01:47:11.760 A1CE Lecture 2: And if it's resource-based… oh! 677 01:47:13.140 --> 01:47:21.390 A1CE Lecture 2: these examples, This example is… is not correct, because if it said that this is resource-based policy. 678 01:47:21.740 --> 01:47:34.719 A1CE Lecture 2: it does not have principle, right? Because every resource-based policy You have to specify… principle, right? So, this one. 679 01:47:37.050 --> 01:47:49.839 A1CE Lecture 2: Is correct, because if we have to use resource-based policy, in policy statement of resource-based policy, you have to specify principle. 680 01:47:51.010 --> 01:47:56.730 A1CE Lecture 2: And this not have principles, so this is not… Correct. 681 01:47:57.330 --> 01:47:58.120 A1CE Lecture 2: Right? 682 01:47:58.700 --> 01:48:00.470 A1CE Lecture 2: Need to… 683 01:48:03.560 --> 01:48:04.720 A1CE Lecture 2: Principal? 684 01:48:06.940 --> 01:48:09.279 A1CE Lecture 2: In syntax, right? 685 01:48:09.600 --> 01:48:13.859 A1CE Lecture 2: That if it's just like this, not correct. 686 01:48:15.450 --> 01:48:16.700 A1CE Lecture 2: This one is correct. 687 01:48:16.950 --> 01:48:25.060 A1CE Lecture 2: principle in the resource-based policy is required, right? But… SID. 688 01:48:26.620 --> 01:48:31.560 A1CE Lecture 2: SID is… it's just like… Commit. 689 01:48:32.090 --> 01:48:45.459 A1CE Lecture 2: Right? So, you can have SID in the policy statement, or you don't have to provide SID in the policy statement. It's okay, right? 690 01:48:47.290 --> 01:48:54.840 A1CE Lecture 2: So, this one don't have SID, so… but it's okay, right? It depends, right? But I… 691 01:48:55.450 --> 01:49:11.280 A1CE Lecture 2: suggest, if you write IAM policy, I suggest you to provide SID, right? Because it's just like command, right? So, so we can say that this is… SID is called B access 1. 692 01:49:11.630 --> 01:49:18.470 A1CE Lecture 2: It may not looking good, but at least I know this is policy for ECOB. 693 01:49:18.570 --> 01:49:37.680 A1CE Lecture 2: Right? But I don't know… I do not know what it acts as one, but at least I get some information that what this policy is used for, right? So, if we create a policy, and this policy may be used 694 01:49:38.840 --> 01:49:40.520 A1CE Lecture 2: by many people. 695 01:49:40.640 --> 01:49:43.550 A1CE Lecture 2: Provide SID definition. 696 01:49:43.870 --> 01:49:51.430 A1CE Lecture 2: Especially what this policy is designed for will be very useful, right? 697 01:49:51.920 --> 01:49:58.689 A1CE Lecture 2: Okay, and this is a thing All of, the important 698 01:50:00.060 --> 01:50:11.069 A1CE Lecture 2: access control, right? We're talking about authentication, right? We… In summary, right, we… In summary… 699 01:50:13.660 --> 01:50:25.879 A1CE Lecture 2: We're talking about all of, basic of access control. We're talking about authentication, we're talking about, what is long-term. 700 01:50:26.900 --> 01:50:28.850 A1CE Lecture 2: Identity, right? 701 01:50:29.720 --> 01:50:31.150 A1CE Lecture 2: I am user. 702 01:50:31.290 --> 01:50:39.570 A1CE Lecture 2: Right? And also, we're talking about two types of long-term credential. Long term. 703 01:50:40.650 --> 01:50:42.129 A1CE Lecture 2: Credential 1. 704 01:50:42.310 --> 01:50:44.979 A1CE Lecture 2: Long-term KDSGNF tool, password. 705 01:50:46.550 --> 01:50:48.960 A1CE Lecture 2: And… programmatic access. 706 01:50:50.790 --> 01:50:57.470 A1CE Lecture 2: Right? So, to highlight… 707 01:51:02.990 --> 01:51:11.940 A1CE Lecture 2: 2… Pre-protect. 708 01:51:14.270 --> 01:51:21.759 A1CE Lecture 2: from… compromise, right? Just loaded the password, or something like that. 709 01:51:22.480 --> 01:51:28.809 A1CE Lecture 2: And we're also talking about, short-term identity. 710 01:51:31.850 --> 01:51:34.420 A1CE Lecture 2: Which is, IAM role. 711 01:51:34.990 --> 01:51:35.700 A1CE Lecture 2: Bye. 712 01:51:36.140 --> 01:51:43.310 A1CE Lecture 2: And… working with, AWS, STS. 713 01:51:43.500 --> 01:51:47.670 A1CE Lecture 2: 4… Temporary token? 714 01:51:48.900 --> 01:51:53.699 A1CE Lecture 2: And we're talking about authorization. 715 01:51:57.110 --> 01:52:00.000 A1CE Lecture 2: Awe? 716 01:52:00.590 --> 01:52:06.170 A1CE Lecture 2: Policy… Evaluate. 717 01:52:08.670 --> 01:52:13.880 A1CE Lecture 2: And what, explicit. 718 01:52:15.530 --> 01:52:16.720 A1CE Lecture 2: Deny? 719 01:52:17.970 --> 01:52:19.650 A1CE Lecture 2: to explicit. 720 01:52:20.800 --> 01:52:21.850 A1CE Lecture 2: Allow. 721 01:52:22.640 --> 01:52:26.019 A1CE Lecture 2: And the last one is MPC deny. 722 01:52:28.280 --> 01:52:35.580 A1CE Lecture 2: And… Resource-based policy? 723 01:52:40.430 --> 01:52:45.260 A1CE Lecture 2: Must… have… Principal? 724 01:52:46.860 --> 01:52:58.339 A1CE Lecture 2: Right? And last thing is, I am… I, not I am, sorry. 725 01:53:00.160 --> 01:53:12.000 A1CE Lecture 2: What we have is that you need to know identity, that… Aws, Support. 726 01:53:12.260 --> 01:53:12.980 A1CE Lecture 2: Right. 727 01:53:13.750 --> 01:53:17.120 A1CE Lecture 2: I am… Do you, sir? 728 01:53:17.690 --> 01:53:21.490 A1CE Lecture 2: I am… blow. 729 01:53:21.670 --> 01:53:26.620 A1CE Lecture 2: I, I am… User group? 730 01:53:28.560 --> 01:53:32.550 A1CE Lecture 2: and… AWS, service. 731 01:53:34.800 --> 01:53:40.580 A1CE Lecture 2: AWS… Echo… producer. 732 01:53:41.870 --> 01:53:45.599 A1CE Lecture 2: And… lastly, federate user. 733 01:53:48.990 --> 01:53:49.770 A1CE Lecture 2: Alright. 734 01:53:49.930 --> 01:53:58.020 A1CE Lecture 2: So, this is identity that AWS supports, and… Oli? 735 01:53:58.860 --> 01:54:02.170 A1CE Lecture 2: I am user… Group. 736 01:54:03.440 --> 01:54:07.770 A1CE Lecture 2: is not principle, right? 737 01:54:08.130 --> 01:54:10.920 A1CE Lecture 2: So, this is important because, at least. 738 01:54:12.480 --> 01:54:21.829 A1CE Lecture 2: For resource-based policy, you must specify principle, so you know what is principle that you can specify in resource-based policy. 739 01:54:22.040 --> 01:54:37.540 A1CE Lecture 2: Principal can be IAM user, can be IAM role, can be AWS service, can be AWS a CalRude user, and can be Federal Red user. But even I say that principal is AWS a call root user, but 740 01:54:38.040 --> 01:54:52.130 A1CE Lecture 2: I think we… we will not specify, or it's gonna be… I never use, AWS Account Reducer in any resource-based policy, right? Because for resource-based policy, you can control 741 01:54:52.240 --> 01:54:58.189 A1CE Lecture 2: which principal can access the resource by specifying IAM user. 742 01:54:58.740 --> 01:55:12.289 A1CE Lecture 2: or specify IAM role, or you specify AWS service, right? Normally, AWS service, what you can specify, AWS service in the principle, mostly. 743 01:55:12.630 --> 01:55:21.609 A1CE Lecture 2: most of the results in AWS there we have… something called ARN number, right? 744 01:55:21.830 --> 01:55:27.020 A1CE Lecture 2: And for AI in number is… a Maison. 745 01:55:27.660 --> 01:55:28.870 A1CE Lecture 2: resource. 746 01:55:29.940 --> 01:55:30.790 A1CE Lecture 2: Number. 747 01:55:31.680 --> 01:55:32.350 A1CE Lecture 2: Right. 748 01:55:33.060 --> 01:55:47.169 A1CE Lecture 2: So, normally, when you specify AWS service, AWS, AM user, AM role, and AM role, normally you use AI and number, right? Normally, but 749 01:55:47.330 --> 01:55:55.720 A1CE Lecture 2: In some cases, you may have another identification, but mostly, in many cases, it's gonna be AIIN number, right? 750 01:55:56.470 --> 01:56:03.680 A1CE Lecture 2: Okay, and let me, check… 751 01:56:04.130 --> 01:56:05.919 A1CE Lecture 2: Let me go back a little bit. 752 01:56:06.530 --> 01:56:14.789 A1CE Lecture 2: What I have to… Okay, I think one of, 753 01:56:14.790 --> 01:56:26.869 A1CE Lecture 2: IAM role uses is… you… you can think about, in many situations. For example, if I explain this diagram, so we have two AWS accounts. 754 01:56:26.870 --> 01:56:33.390 A1CE Lecture 2: Right? You have AWS account 1, right? AWS account 2, right? But if you want 755 01:56:33.520 --> 01:56:43.540 A1CE Lecture 2: if I am a user, for example, this is, for me as the School of IT, right? This is CMKL, right? 756 01:56:43.540 --> 01:56:55.359 A1CE Lecture 2: So, if I… I already have, I am user in the School of IT, but if I'm gonna work for CMKL as a part-time. 757 01:56:55.400 --> 01:57:01.719 A1CE Lecture 2: So, I… I want to exit the resource in AWS Echo 1, but because 758 01:57:01.930 --> 01:57:07.369 A1CE Lecture 2: I am identity in another account. So, by default. 759 01:57:07.550 --> 01:57:11.390 A1CE Lecture 2: Different account, yes, we cannot access. 760 01:57:11.630 --> 01:57:21.540 A1CE Lecture 2: the resource in another account. So, when I work part-time with CMKL, what the CMKL admin have to do is… 761 01:57:22.330 --> 01:57:24.589 A1CE Lecture 2: CMKL admin create. 762 01:57:25.300 --> 01:57:29.760 A1CE Lecture 2: I am role, right? I am role that's for me to use, right? 763 01:57:29.950 --> 01:57:39.399 A1CE Lecture 2: And they assign, the policy, right? So aside the policy, any policy that, okay, I can maybe read. 764 01:57:39.700 --> 01:57:41.660 A1CE Lecture 2: H3 bucket. 765 01:57:42.000 --> 01:57:49.839 A1CE Lecture 2: policy, right? And what I can do is I can assume, right? But before I can assume. 766 01:57:49.980 --> 01:57:55.109 A1CE Lecture 2: I have to set that in this role, allow. 767 01:57:57.320 --> 01:58:09.070 A1CE Lecture 2: I have to say that this role allowed to be Assume… by… act cow… 2. 768 01:58:09.360 --> 01:58:10.810 A1CE Lecture 2: And… 769 01:58:11.030 --> 01:58:24.700 A1CE Lecture 2: not only at how to, and I said that at Cal2, and also I am user account 2, right? I have to set that, okay, this role can be assumed by this 770 01:58:24.860 --> 01:58:28.679 A1CE Lecture 2: identity, right? So, when I try to assume. 771 01:58:28.790 --> 01:58:35.309 A1CE Lecture 2: Okay, it will check that, oh, okay, this role can be assumed by this, and when I assume. 772 01:58:35.650 --> 01:58:47.060 A1CE Lecture 2: I get temporary access, right? So, I can request or access the data that is in S3 bucket, because I can assume this role. And 773 01:58:47.060 --> 01:58:55.700 A1CE Lecture 2: It's also the same if this is CMKL and School of IT. I may form other, maybe I'm from… 774 01:58:57.260 --> 01:58:58.170 A1CE Lecture 2: Cisco. 775 01:58:58.380 --> 01:59:13.120 A1CE Lecture 2: outside, not AWS account. Maybe from Cisco, Cisco, okay, another domain, and if I want to do that, yes, possible, right? If I just say that, okay, this account can be assumed by 776 01:59:13.400 --> 01:59:18.140 A1CE Lecture 2: Cisco, right? Cisco domain is possible, but it's a little bit… 777 01:59:18.690 --> 01:59:23.629 A1CE Lecture 2: tricky, right? You have to set IM, right? 778 01:59:23.760 --> 01:59:28.619 A1CE Lecture 2: And… you want to make sure that I am of this AWS account. 779 01:59:29.580 --> 01:59:37.219 A1CE Lecture 2: can communicate with Cisco Identity Server, right? So, if we can connect 780 01:59:37.380 --> 01:59:41.459 A1CE Lecture 2: I am in our AWS account to Cisco server. 781 01:59:42.240 --> 01:59:49.469 A1CE Lecture 2: When we… when I tried to log in, I just said, okay, my name is Lapad at Cisco.com. 782 01:59:50.350 --> 02:00:02.580 A1CE Lecture 2: And this is my password. And the IAM of my account can check with the Cisco server, and if I authent, pass, I can access AWS environment. 783 02:00:02.700 --> 02:00:04.860 A1CE Lecture 2: Using IAM rule. 784 02:00:05.230 --> 02:00:10.060 A1CE Lecture 2: And I will have temporary access, right? 785 02:00:10.560 --> 02:00:16.759 A1CE Lecture 2: So… Next, I will want you to, 786 02:00:16.880 --> 02:00:24.070 A1CE Lecture 2: try to access. So, make sure… I'm not sure that I have to log in again, yes? 787 02:00:24.510 --> 02:00:28.460 A1CE Lecture 2: Okay, so, the next part is… 788 02:00:28.780 --> 02:00:36.470 A1CE Lecture 2: Because we… we already finished the lecture, but… This week, you will have… 789 02:00:36.950 --> 02:00:39.399 A1CE Lecture 2: You would have to do the lab, right? 790 02:00:39.620 --> 02:00:45.260 A1CE Lecture 2: So… I will… Explain. 791 02:00:45.500 --> 02:00:50.410 A1CE Lecture 2: How to use AWS Academy. 792 02:00:50.590 --> 02:00:54.290 A1CE Lecture 2: resource, right? And you have to do the lab. 793 02:00:54.560 --> 02:01:03.430 A1CE Lecture 2: Let's make sure that I enter… Okay. 794 02:01:07.050 --> 02:01:08.210 A1CE Lecture 2: Okay… 795 02:01:26.970 --> 02:01:31.249 A1CE Lecture 2: Okay, let's go through the cause. 796 02:01:34.280 --> 02:01:36.630 A1CE Lecture 2: Okay, this one. 797 02:01:40.790 --> 02:01:42.350 A1CE Lecture 2: Okay, 798 02:01:43.160 --> 02:01:49.940 A1CE Lecture 2: We will go to do the lab for this week, one of the assignments, apart from, 799 02:01:50.340 --> 02:02:02.210 A1CE Lecture 2: the Google Form, that I will provide to you, I think maybe at the end of today, or maybe tomorrow. What you have to do for this week is GuideLab. 800 02:02:02.410 --> 02:02:09.220 A1CE Lecture 2: Right? Explore AWS Identity and Access Management, and Module 3, Knowledge Check, right? 801 02:02:09.610 --> 02:02:18.120 A1CE Lecture 2: Okay, just when you want to… if you want to do the lab, you just click to this, guide lab, right? 802 02:02:23.730 --> 02:02:26.490 A1CE Lecture 2: And it will take you to the lab. 803 02:02:26.760 --> 02:02:30.990 A1CE Lecture 2: But for me, it just feels more click, because I'm, 804 02:02:31.290 --> 02:02:36.860 A1CE Lecture 2: I am teacher of this class, so I have to access the student view first. 805 02:02:37.130 --> 02:02:39.199 A1CE Lecture 2: But when you click at the Kylab. 806 02:02:39.360 --> 02:02:42.660 A1CE Lecture 2: It will take you to this, 807 02:02:43.930 --> 02:02:49.699 A1CE Lecture 2: AWS, Academy Lab environment. Spokello, right? 808 02:02:49.870 --> 02:02:55.680 A1CE Lecture 2: The first thing, when you enter the lab, right, the instruction? 809 02:02:55.840 --> 02:02:59.179 A1CE Lecture 2: It will provide if it's a guide lab. 810 02:03:00.000 --> 02:03:11.800 A1CE Lecture 2: The detailed instruction will be provided, so you can just follow the step, right? But for this lab, I think it requires you to use private tab. 811 02:03:12.050 --> 02:03:12.770 A1CE Lecture 2: Right. 812 02:03:13.690 --> 02:03:18.919 A1CE Lecture 2: And… When you try to… 813 02:03:19.550 --> 02:03:32.859 A1CE Lecture 2: want to do the lab, the first thing that you have to do is start the lab, because, is there a red dots here? It means that it's still not ready, so we have to start the lab first. Click start the lab. 814 02:03:33.640 --> 02:03:38.729 A1CE Lecture 2: And… with… A little bit, so it will change… 815 02:03:39.590 --> 02:03:50.929 A1CE Lecture 2: from red to yellow, and to green, right? If it changes to green, this means that the lab environment is ready, right? 816 02:03:52.150 --> 02:04:03.599 A1CE Lecture 2: So, we wait a little bit. So, but right now, you may see that you have time, right? 3 hours, right? It means, the envelopment for this lab 817 02:04:03.750 --> 02:04:14.360 A1CE Lecture 2: will be available for 3 hours, right? If it reaches zero, it means everything will be terminated, right? 818 02:04:15.160 --> 02:04:17.259 A1CE Lecture 2: So we wait. 819 02:04:18.010 --> 02:04:20.319 A1CE Lecture 2: Right? We wait, 820 02:04:26.200 --> 02:04:39.110 A1CE Lecture 2: Until the lab is ready. So, it will take, normally, in most labs, it will take about, within 5 minutes to set up the lab environment. 821 02:04:42.180 --> 02:04:45.279 A1CE Lecture 2: So, just waiting a little bit. 822 02:04:48.780 --> 02:04:58.790 A1CE Lecture 2: And… You can see here that, after you finish the lab, you have to click Submit. 823 02:04:59.070 --> 02:05:09.270 A1CE Lecture 2: Right? Submit, we'll, mark, what you have to do in the lab. If you do everything correct, you will get 824 02:05:09.600 --> 02:05:20.909 A1CE Lecture 2: full mark for all the submission, and it will be record in this, AWS Academy, portal, right? So I can check. And… 825 02:05:20.990 --> 02:05:31.100 A1CE Lecture 2: for this course, as Matt asked, but I also will specify in, CMK or Canvas, that for lab and knowledge check. 826 02:05:31.480 --> 02:05:36.370 A1CE Lecture 2: You have to get 80% 827 02:05:36.800 --> 02:05:46.459 A1CE Lecture 2: or more, right? More than… it's at least 80% or more. If you get the marking for… 828 02:05:46.680 --> 02:06:01.189 A1CE Lecture 2: each lab that I assign, and you get 80%, and also the knowledge check, you get 80% or more, you get full score, right? Full score for that assignment, right? 829 02:06:01.980 --> 02:06:09.739 A1CE Lecture 2: Okay, when this is changed to green, it means the lab is ready, right? 830 02:06:09.960 --> 02:06:17.599 A1CE Lecture 2: You can click this, it's not a button, but yes, you can click this, to open 831 02:06:18.250 --> 02:06:26.009 A1CE Lecture 2: the new browser, and this is the AWS Management Console that you can use to do the lab. 832 02:06:26.180 --> 02:06:35.420 A1CE Lecture 2: If it's not specified, please make sure that you do the lab in 833 02:06:35.560 --> 02:06:48.459 A1CE Lecture 2: US East 1 region, or North Virginia, right? Make sure that the AWS Management Console is in US East 1, or North Virginia. 834 02:06:48.580 --> 02:06:57.550 A1CE Lecture 2: You may need to work in another AWS region, but only if 835 02:06:57.710 --> 02:07:03.669 A1CE Lecture 2: Another region to use is specified in the lab instruction. 836 02:07:03.850 --> 02:07:09.260 A1CE Lecture 2: So, if lab instruction Do not specify anything. 837 02:07:09.800 --> 02:07:14.720 A1CE Lecture 2: Make sure that you use AWS that… 838 02:07:15.030 --> 02:07:28.959 A1CE Lecture 2: only in Northern Virginia, right, or US is one. But 99.9% of the time, when you access the web console, management console for the lab, it will be at North Virginia region. 839 02:07:30.240 --> 02:07:32.680 A1CE Lecture 2: So, just make sure, right? 840 02:07:34.940 --> 02:07:38.419 A1CE Lecture 2: One thing that I have to, 841 02:07:38.560 --> 02:07:47.579 A1CE Lecture 2: show is… you can see here, right, on the right, top right of the browser, And you click. 842 02:07:50.040 --> 02:07:56.489 A1CE Lecture 2: You will see that you log in to this AWS environment using Federate User. 843 02:07:56.980 --> 02:08:01.470 A1CE Lecture 2: Right? So, we already learned about that today. So… 844 02:08:02.060 --> 02:08:12.780 A1CE Lecture 2: what… what does it mean, right? You enter this AWS account by using Identity, form. 845 02:08:13.290 --> 02:08:17.119 A1CE Lecture 2: the domain outside AWS. But which domain? 846 02:08:18.120 --> 02:08:29.340 A1CE Lecture 2: this domain, right? You enter AWS environment using AWS Academy identity, right? So right now, what 847 02:08:29.750 --> 02:08:44.459 A1CE Lecture 2: AWS Academy do in the back end is AWS Academy has a database account for the lab environment, and they config what I explained to you, right, in this slide. 848 02:08:44.570 --> 02:08:51.540 A1CE Lecture 2: That… This is, if I'm gonna say it, this is… AWS… Academy? 849 02:08:51.660 --> 02:08:58.770 A1CE Lecture 2: which is not AWS account, right? We are the outside of AWS environment. And for… 850 02:08:58.890 --> 02:09:05.159 A1CE Lecture 2: doing the lab for each of you, AWS Academy has multiple AWS accounts. 851 02:09:05.390 --> 02:09:12.839 A1CE Lecture 2: And it already connects identity access management of this account to AWS Academy. 852 02:09:12.920 --> 02:09:25.659 A1CE Lecture 2: So, when you log in, right now, you are logged in as the federate user, and you assume the role in this AWS account. 853 02:09:26.470 --> 02:09:32.480 A1CE Lecture 2: Why… why I can say that we assume the role, right? Because… 854 02:09:35.850 --> 02:09:36.560 A1CE Lecture 2: Yes. 855 02:09:36.980 --> 02:09:47.360 A1CE Lecture 2: there's time limit, right? So, that's… that is one of things that you can see, right? Right now, we are outside of AWS. 856 02:09:47.560 --> 02:10:00.010 A1CE Lecture 2: Right? And we enter AWS, so we using temporary access, right? You… we already using temporary access, because we just can't use this for 857 02:10:01.200 --> 02:10:14.159 A1CE Lecture 2: specific period of time. So this is not default value. This is 3 hours, right? But I think I use AWS Academy for 6 years now. As forb is 4 hours. 858 02:10:14.380 --> 02:10:30.930 A1CE Lecture 2: For every lap, it's 4 hours. But that is because 6 years ago, the default value for temporary token is 4 hours. It's 4 hours, it's 8 hours, and right now it's 12 hours, right? I don't know. 859 02:10:31.150 --> 02:10:36.910 A1CE Lecture 2: I don't know what it's gonna be in the next 2 years, right? But… 860 02:10:37.140 --> 02:10:45.610 A1CE Lecture 2: This is the lab environment, right? So, okay, so you have 3 hours. One thing that… 861 02:10:45.740 --> 02:10:59.969 A1CE Lecture 2: If you want to go to lunch, and you want to come back to do the lab, continue to do the lab, but you're afraid that the time limit will be reached zero, you can click start again to 862 02:11:00.270 --> 02:11:11.939 A1CE Lecture 2: renew the session, right? So you can start again. And it will renew something like this, and it will change back to 3 hours, right? 863 02:11:12.600 --> 02:11:21.370 A1CE Lecture 2: So, you can, renew if you want, right? We'll just extend the session. And… 864 02:11:21.810 --> 02:11:28.629 A1CE Lecture 2: Another thing, is I want you have to look at AWS detail here, then you can click. 865 02:11:29.890 --> 02:11:43.159 A1CE Lecture 2: And it will provide information. For example, if you don't want to use Management Console, you want to connect to AWS envelopment of the lab using CLI, 866 02:11:43.480 --> 02:11:49.640 A1CE Lecture 2: You can use this setup access key, secret access key, and session token. 867 02:11:49.730 --> 02:12:07.830 A1CE Lecture 2: Right? You copy that, and, to the credential file in the AWS directory, if you install AWS CLI, it will create this part, right? And you will copy this and paste into the credential file, and you can use that, but 868 02:12:07.830 --> 02:12:11.520 A1CE Lecture 2: It only can use for this session. 869 02:12:11.960 --> 02:12:12.630 A1CE Lecture 2: Right. 870 02:12:12.990 --> 02:12:16.389 A1CE Lecture 2: So, if you… Click start again. 871 02:12:16.790 --> 02:12:18.179 A1CE Lecture 2: This is renew. 872 02:12:18.300 --> 02:12:21.989 A1CE Lecture 2: And it chained, right? So make sure that… that… 873 02:12:22.040 --> 02:12:25.960 A1CE Lecture 2: So this is for command line interface, right? And… 874 02:12:25.980 --> 02:12:44.980 A1CE Lecture 2: In some labs, you will ask about the secure share key. If you install it in the EC2, you can download it here, right? Anything that you want to use, you can download it here, or you want to share your session with your friends, you can download this URL. 875 02:12:45.510 --> 02:12:46.280 A1CE Lecture 2: Bye. 876 02:12:47.500 --> 02:12:55.740 A1CE Lecture 2: And also, send this URL to your friends, but… And you can just… 877 02:12:59.410 --> 02:13:02.600 A1CE Lecture 2: enter the environment. The same environment. 878 02:13:03.540 --> 02:13:04.550 A1CE Lecture 2: As you. 879 02:13:04.730 --> 02:13:10.040 A1CE Lecture 2: As you use, that you can share. But normally, this is individual. 880 02:13:10.280 --> 02:13:24.079 A1CE Lecture 2: So, normally you don't want to share this, because what your friend do with this management console will also, in the same environment that you work with, so it's gonna be a problem, because, 881 02:13:25.220 --> 02:13:31.420 A1CE Lecture 2: you can submit. So, for example, if you finish, you do everything, And… 882 02:13:31.770 --> 02:13:47.670 A1CE Lecture 2: I make sure that if they specify to config anything, make sure that you config everything based on what the instruction tells you to do. If they want to say that 883 02:13:47.880 --> 02:13:48.790 A1CE Lecture 2: Please? 884 02:13:49.020 --> 02:13:53.540 A1CE Lecture 2: using the name S3 Support for something like this. 885 02:13:54.030 --> 02:13:59.310 A1CE Lecture 2: capital S, everything have to be matched, because when you submit 886 02:13:59.460 --> 02:14:02.900 A1CE Lecture 2: it's just like Python script to check the name. 887 02:14:03.050 --> 02:14:13.140 A1CE Lecture 2: And if the name, even the name is similar, but it's not capital letter, it will say that this is a different resource, and it will mark you zero. 888 02:14:13.250 --> 02:14:18.740 A1CE Lecture 2: Right? So make sure that you follow the instruction closely, right? 889 02:14:19.560 --> 02:14:22.770 A1CE Lecture 2: And when you submit, Click Submit. 890 02:14:23.250 --> 02:14:36.489 A1CE Lecture 2: And you can submit anytime, right? So, if you submit and it's still not full score, and you can make a change, because, in the submission report, it will provide 891 02:14:37.500 --> 02:14:44.750 A1CE Lecture 2: the error, or anything that you're not, not doing correctly. 892 02:14:45.820 --> 02:14:55.290 A1CE Lecture 2: But I have to say, in some situations, it may have some error. 893 02:14:55.970 --> 02:15:04.900 A1CE Lecture 2: in the script, and this is the total score, and it's… I say that… it said that I don't get any point, which is… 894 02:15:05.070 --> 02:15:06.020 A1CE Lecture 2: Yes? 895 02:15:06.310 --> 02:15:17.150 A1CE Lecture 2: I still not do anything, so I cannot get any scores correct. But you can look at what you are missing by click Submission Report, right? And… 896 02:15:17.200 --> 02:15:30.319 A1CE Lecture 2: it will tell you a little bit about what you have, what you're missing, right? But I have to say, it's not every time that sometimes submission report is not 897 02:15:30.920 --> 02:15:35.700 A1CE Lecture 2: is not useful at all. But… and you… you can… 898 02:15:35.970 --> 02:15:41.439 A1CE Lecture 2: you can have a look, and you can submit again, right? But if sometime 899 02:15:42.100 --> 02:15:49.499 A1CE Lecture 2: You… you… you are sure that you do everything correctly, but still not marked as complete? 900 02:15:50.880 --> 02:15:51.980 A1CE Lecture 2: You may just… 901 02:15:52.170 --> 02:16:00.220 A1CE Lecture 2: in the lab, and maybe the next day, you try to do it again. Maybe there's some bug, some problem in some lab. 902 02:16:00.810 --> 02:16:09.289 A1CE Lecture 2: That it may cost. But as, my experience for this semester, all the lab for this course. 903 02:16:10.100 --> 02:16:16.509 A1CE Lecture 2: you should be okay, because the lab that I have been report with problem. 904 02:16:16.890 --> 02:16:36.740 A1CE Lecture 2: it's not for this course, right? So, it should be okay. So, this is how you do the lab, and when you finish the lab, you can click end, right? You don't have to wait until the time reach zero, but everything, if you do everything completely, you get all the score, you can click end lab. 905 02:16:36.760 --> 02:16:40.530 A1CE Lecture 2: Right? But if you start the lab again. 906 02:16:40.870 --> 02:16:48.229 A1CE Lecture 2: The score that the system will maintain is the latest attempt. 907 02:16:48.340 --> 02:17:03.280 A1CE Lecture 2: Right? So, make sure that the letter attempt is more than or equal to 80%, right? So, if… because if you do it again, and you get less than 80, 908 02:17:03.459 --> 02:17:14.409 A1CE Lecture 2: it will only record. If you get 70, it will record 70, and it will not get… you will not get full score, for this… for this assignment, right? 909 02:17:15.250 --> 02:17:16.090 A1CE Lecture 2: Okay. 910 02:17:17.790 --> 02:17:29.219 A1CE Lecture 2: I think that's, that's all, for the lab for today, but, I also have, I think I also, 911 02:17:29.389 --> 02:17:36.979 A1CE Lecture 2: You will have be… have to be invited, to join another cause, right? You will have… 912 02:17:37.110 --> 02:17:51.460 A1CE Lecture 2: two cores, right? AWS Academy, Cloud Architect, and AWS Academy Learner Lab, right? For Learner Lab, it's quite similar, right? When you launch, AWS Academy Learner Lab. 913 02:17:51.990 --> 02:17:56.300 A1CE Lecture 2: It also will take you, to the lab environment. 914 02:17:58.360 --> 02:18:00.399 A1CE Lecture 2: So I terminate, that's alright. 915 02:18:00.580 --> 02:18:03.490 A1CE Lecture 2: closed, this lab, right? 916 02:18:03.990 --> 02:18:09.170 A1CE Lecture 2: And… So… Okay… 917 02:18:20.120 --> 02:18:26.229 A1CE Lecture 2: I go to learn the lab, right? Fall in a lap. 918 02:18:26.600 --> 02:18:36.890 A1CE Lecture 2: Right? You can experiment, right? This is a sandbox, the closest to the sandbox environment, and everyone 919 02:18:37.170 --> 02:18:40.529 A1CE Lecture 2: You will get 50 US dollar. 920 02:18:40.680 --> 02:18:43.430 A1CE Lecture 2: credit, right? You can use all of this 921 02:18:43.670 --> 02:18:55.679 A1CE Lecture 2: without any credit card at all, you can use this. And for what you can use is also specified in this document. So. 922 02:18:55.920 --> 02:19:10.530 A1CE Lecture 2: You can use, Learner Lab, right? But you can only create resource in US East 1 or US West 2. Only this two regions is available in the lab, and 923 02:19:10.930 --> 02:19:21.680 A1CE Lecture 2: service that you can use is not everything. For 50 US dollars, you can use this following service. And some service, you may… 924 02:19:21.990 --> 02:19:29.130 A1CE Lecture 2: have some restriction, right? For example, for VM EC2, 925 02:19:30.219 --> 02:19:39.229 A1CE Lecture 2: You can use Amazon Linux, or use Microsoft Windows, but other OS than this, you may not be able to use. 926 02:19:39.350 --> 02:19:55.020 A1CE Lecture 2: And instant type, you can use, nano, instant type, micro, small, medium, and large. And not extra large, not extra large, not extra, extra large, right? So, you just only limit. 927 02:19:55.130 --> 02:19:58.740 A1CE Lecture 2: To specific size of instant, right? 928 02:19:58.940 --> 02:19:59.910 A1CE Lecture 2: And… 929 02:20:00.600 --> 02:20:12.700 A1CE Lecture 2: So, you have to check, because, it provides you the sandbox that you can test anything that you want to learn, but… 930 02:20:12.910 --> 02:20:20.529 A1CE Lecture 2: it will not, support everything, right, that you want, right? So, if you want everything. 931 02:20:20.790 --> 02:20:25.159 A1CE Lecture 2: I may suggest you to use AWS Free Tier, but… 932 02:20:25.300 --> 02:20:31.679 A1CE Lecture 2: Free tier, you still have to, work to add the credit card information. 933 02:20:31.980 --> 02:20:36.319 A1CE Lecture 2: So, at the beginning, if you're still not 934 02:20:36.550 --> 02:20:44.610 A1CE Lecture 2: Because if you, open AWS account and validate your credit card information, 935 02:20:44.900 --> 02:21:01.829 A1CE Lecture 2: It's… it's okay, but, you may accidentally, forget something, and if… if you are unlucky, the service that you test is expensive service, and that is gonna cost you… but… 936 02:21:02.040 --> 02:21:05.630 A1CE Lecture 2: If it costs you too much, we have… 937 02:21:05.870 --> 02:21:17.209 A1CE Lecture 2: one time that we can contact open ticket to AWS Helix, and say that you, made something, some mistake, and can you reimburse? 938 02:21:17.580 --> 02:21:26.920 A1CE Lecture 2: the… the… the usage, okay? Reimburse what, what database chart, I think you can. 939 02:21:27.860 --> 02:21:28.760 A1CE Lecture 2: One time. 940 02:21:29.120 --> 02:21:42.199 A1CE Lecture 2: Right? They allow… because I have been done that before, so I know that we allow to make a mistake one time, and it's re… AWS will reimburse, the expense for us. 941 02:21:42.500 --> 02:21:51.079 A1CE Lecture 2: But you, you can use database free tier. But, for, this, I think you can, 942 02:21:51.180 --> 02:21:55.439 A1CE Lecture 2: experiment and try to do. 943 02:21:56.080 --> 02:22:00.739 A1CE Lecture 2: And also, I think the… one of the assignments, is… 944 02:22:00.910 --> 02:22:04.880 A1CE Lecture 2: Oh, I… I will ask you to deploy any service. 945 02:22:05.170 --> 02:22:16.069 A1CE Lecture 2: in AWS environment, so I will ask you to do, do, to think about that assignment and using Learner Lab. So, make sure that you check 946 02:22:16.330 --> 02:22:26.650 A1CE Lecture 2: the service that support in Learning Lab, and… Okay, if you use awe, of 50 US dollar. 947 02:22:27.040 --> 02:22:28.970 A1CE Lecture 2: And you're still not complete. 948 02:22:29.130 --> 02:22:41.739 A1CE Lecture 2: the task, or you're not complete the project yet, I can add you to another course, right? So you will have one more, one more learner lab for you to use, right? So just contact me, 949 02:22:42.030 --> 02:22:44.050 A1CE Lecture 2: I will provide that to you, but… 950 02:22:44.180 --> 02:22:48.300 A1CE Lecture 2: Try to do this in a learner lab first, right? 951 02:22:48.870 --> 02:22:50.790 A1CE Lecture 2: Oh. 952 02:22:51.090 --> 02:22:57.230 A1CE Lecture 2: Okay, I think that's all but one information, because next week, 953 02:22:58.650 --> 02:23:05.209 A1CE Lecture 2: I think I'm not available for… in the Tuesday morning, so… 954 02:23:05.610 --> 02:23:21.509 A1CE Lecture 2: I will record. I make the video, right, for next week lecture, and I will set up the time, right, likely to be the whole Fridays, that you, if you want to have discussion, it can be, 955 02:23:22.740 --> 02:23:32.089 A1CE Lecture 2: mark the time, and I can be here in CMKL on Fridays, or… We… we can have, 956 02:23:32.240 --> 02:23:42.939 A1CE Lecture 2: online meeting, if you want. So, for next week, it's gonna be, video. I will upload video in the Canvas, before Tuesday morning. 957 02:23:43.310 --> 02:23:58.530 A1CE Lecture 2: And I will set up the time that if you have any questions, anything that you want to discuss, I think it's gonna be on Fridays, for the holidays, because I available the holidays. 958 02:23:58.530 --> 02:24:07.910 A1CE Lecture 2: So, if you want to discuss or anything, you can contact me via the canvas, and we can set up the meeting time on Fridays. 959 02:24:08.300 --> 02:24:16.349 A1CE Lecture 2: Okay, any… any questions? Sorry that I'm a little bit later than, 960 02:24:16.660 --> 02:24:21.559 A1CE Lecture 2: 24 past 11. Any questions before we, finish the class? 961 02:24:34.310 --> 02:24:36.750 A1CE Lecture 2: Okay, it… oops. 962 02:24:38.830 --> 02:24:50.019 A1CE Lecture 2: Okay, if there's no question, so thank you very much for today, and, next… next week, we'll be recording video on Tuesday, and we said… we can set up meet… 963 02:24:50.240 --> 02:24:54.159 A1CE Lecture 2: discussion or meeting on Friday, okay? Thank you very much.