3855 lines
120 KiB
Plaintext
3855 lines
120 KiB
Plaintext
WEBVTT
|
|
|
|
1
|
|
00:04:31.800 --> 00:04:32.880
|
|
matt: Hello.
|
|
|
|
2
|
|
00:15:29.510 --> 00:15:31.149
|
|
A1CE Lecture 2: Hello, hold on. Oh.
|
|
|
|
3
|
|
00:15:31.270 --> 00:15:32.869
|
|
A1CE Lecture 2: Okay, thank you.
|
|
|
|
4
|
|
00:16:00.890 --> 00:16:06.679
|
|
A1CE Lecture 2: Okay, everyone, you know… This out clearly.
|
|
|
|
5
|
|
00:16:20.490 --> 00:16:29.779
|
|
A1CE Lecture 2: Again, you can type… In the chat, if you can hear this, clear.
|
|
|
|
6
|
|
00:16:30.850 --> 00:16:31.970
|
|
A1CE Lecture 2: Okay, thank you.
|
|
|
|
7
|
|
00:16:32.660 --> 00:16:33.600
|
|
A1CE Lecture 2: Okay.
|
|
|
|
8
|
|
00:16:33.930 --> 00:16:36.580
|
|
A1CE Lecture 2: Okay.
|
|
|
|
9
|
|
00:16:42.970 --> 00:16:49.530
|
|
A1CE Lecture 2: Okay, thank you very much. So, I'm sorry for… Keep you waiting.
|
|
|
|
10
|
|
00:16:50.190 --> 00:16:55.960
|
|
A1CE Lecture 2: Okay, so if everyone can hear, clearly, so we can start.
|
|
|
|
11
|
|
00:16:56.260 --> 00:16:59.290
|
|
A1CE Lecture 2: Okay.
|
|
|
|
12
|
|
00:17:02.070 --> 00:17:02.940
|
|
A1CE Lecture 2: Oops.
|
|
|
|
13
|
|
00:17:11.800 --> 00:17:16.710
|
|
A1CE Lecture 2: Okay, this is SYS302 Cloud Computing.
|
|
|
|
14
|
|
00:17:26.780 --> 00:17:38.450
|
|
A1CE Lecture 2: Me too. Okay, so, for this week, we, as we… Is. Not.
|
|
|
|
15
|
|
00:17:39.120 --> 00:17:46.830
|
|
A1CE Lecture 2: Okay… How I can… Good.
|
|
|
|
16
|
|
00:17:49.530 --> 00:17:50.750
|
|
A1CE Lecture 2: Okay.
|
|
|
|
17
|
|
00:17:53.300 --> 00:17:59.919
|
|
A1CE Lecture 2: Okay, so for this week, as we mentioned before,
|
|
|
|
18
|
|
00:18:00.140 --> 00:18:02.580
|
|
A1CE Lecture 2: We will talk about, basic.
|
|
|
|
19
|
|
00:18:02.720 --> 00:18:03.850
|
|
A1CE Lecture 2: Security?
|
|
|
|
20
|
|
00:18:12.950 --> 00:18:26.410
|
|
A1CE Lecture 2: Right? And the presentation is, I will use this securing the access for AWS Academy Cloud Architect, and I think this is, ACA Model 3, right?
|
|
|
|
21
|
|
00:18:26.480 --> 00:18:40.139
|
|
A1CE Lecture 2: But as I mentioned before, we will be talking about, by using this written, slide that I will upload, in…
|
|
|
|
22
|
|
00:18:40.360 --> 00:18:48.799
|
|
A1CE Lecture 2: the canvas, right? And, sorry, the record of, the previous week, I also will upload, which had the link.
|
|
|
|
23
|
|
00:18:48.950 --> 00:18:51.289
|
|
A1CE Lecture 2: In the canvas, I think.
|
|
|
|
24
|
|
00:18:51.400 --> 00:18:55.299
|
|
A1CE Lecture 2: I think during the break, or after today's class, right?
|
|
|
|
25
|
|
00:18:56.220 --> 00:19:14.790
|
|
A1CE Lecture 2: Okay, so, let's get started, because I think we… we… before we can set up, and I keep all of you waiting for a long time. First thing is, we're talking about what is the basic security in the cloud.
|
|
|
|
26
|
|
00:19:16.010 --> 00:19:24.069
|
|
A1CE Lecture 2: So, this is just, overview. When we try to deploy,
|
|
|
|
27
|
|
00:19:24.510 --> 00:19:33.200
|
|
A1CE Lecture 2: any service, anything, any resource that we deploy, for example, if we deploy in AWS, we deploy the source
|
|
|
|
28
|
|
00:19:34.160 --> 00:19:36.139
|
|
A1CE Lecture 2: One resource in the cloud.
|
|
|
|
29
|
|
00:19:36.380 --> 00:19:43.549
|
|
A1CE Lecture 2: Normally for… it can be, AWS, it can be GCP, it can be Azure.
|
|
|
|
30
|
|
00:19:44.030 --> 00:19:49.150
|
|
A1CE Lecture 2: It's… Any of this is, I think, based on the same,
|
|
|
|
31
|
|
00:19:50.440 --> 00:19:57.250
|
|
A1CE Lecture 2: Same… the same thing, right? Because we deploy something in the public cloud environment.
|
|
|
|
32
|
|
00:19:59.970 --> 00:20:06.580
|
|
A1CE Lecture 2: Right? So, one of, the main… Requirement.
|
|
|
|
33
|
|
00:20:06.680 --> 00:20:13.240
|
|
A1CE Lecture 2: Right? When you deploy anything in the cloud, you need…
|
|
|
|
34
|
|
00:20:13.620 --> 00:20:18.169
|
|
A1CE Lecture 2: internet access, right? So, I draw the, internet, yeah?
|
|
|
|
35
|
|
00:20:19.490 --> 00:20:20.410
|
|
A1CE Lecture 2: So…
|
|
|
|
36
|
|
00:20:20.720 --> 00:20:31.269
|
|
A1CE Lecture 2: If you want to access to anything in the cloud, right, you will have to go through the public internet, and go through,
|
|
|
|
37
|
|
00:20:31.580 --> 00:20:36.770
|
|
A1CE Lecture 2: The resource that you deploy and available in the cloud.
|
|
|
|
38
|
|
00:20:37.390 --> 00:20:51.560
|
|
A1CE Lecture 2: But because you need internet access, right, to access to the cloud service, right? So, it is also possible that there's multiple… it can be multiple users.
|
|
|
|
39
|
|
00:20:52.430 --> 00:21:03.669
|
|
A1CE Lecture 2: that also, can access to the internet. And… Very likely that they also can…
|
|
|
|
40
|
|
00:21:04.100 --> 00:21:13.070
|
|
A1CE Lecture 2: try to access the resource that you provide and you deploy in the cloud, right? And some users, Right?
|
|
|
|
41
|
|
00:21:13.190 --> 00:21:16.980
|
|
A1CE Lecture 2: That… it can be multiple types of user.
|
|
|
|
42
|
|
00:21:24.060 --> 00:21:24.870
|
|
A1CE Lecture 2: But…
|
|
|
|
43
|
|
00:21:25.530 --> 00:21:40.440
|
|
A1CE Lecture 2: we may not need everyone, right? In some… in some case, it is possible that you want to share the resource that you put in the cloud for everyone, but mostly.
|
|
|
|
44
|
|
00:21:41.050 --> 00:21:46.669
|
|
A1CE Lecture 2: normally, we… we don't want everyone, right? Because we just want,
|
|
|
|
45
|
|
00:21:46.990 --> 00:21:51.410
|
|
A1CE Lecture 2: the authorized, or the user that, that we
|
|
|
|
46
|
|
00:21:51.510 --> 00:22:07.630
|
|
A1CE Lecture 2: allow, right? For example, the client in the green color is the client request that we allow to access your resource in the cloud. And the laptop or the client in red, I think.
|
|
|
|
47
|
|
00:22:08.170 --> 00:22:09.269
|
|
A1CE Lecture 2: We don't want.
|
|
|
|
48
|
|
00:22:10.270 --> 00:22:15.360
|
|
A1CE Lecture 2: these requests to be able to access the cloud. But okay, you also want
|
|
|
|
49
|
|
00:22:15.470 --> 00:22:30.850
|
|
A1CE Lecture 2: because we are, if we run anything in the cloud, we also not, connect directly to the AWS infrastructure, right? We also need to access, if we are admin or cloud admin.
|
|
|
|
50
|
|
00:22:30.990 --> 00:22:45.489
|
|
A1CE Lecture 2: We also need to access the resource that we deploy in the cloud, right? So we want some of the requests to be able to access to the cloud, and some of the requests we want to prevent.
|
|
|
|
51
|
|
00:22:45.840 --> 00:22:46.610
|
|
A1CE Lecture 2: Right.
|
|
|
|
52
|
|
00:22:46.720 --> 00:22:58.620
|
|
A1CE Lecture 2: So… To do this, This is the basic security requirement, right? It's… is called, access control, right?
|
|
|
|
53
|
|
00:23:00.790 --> 00:23:10.329
|
|
A1CE Lecture 2: It's very basic, security process, but it's quite important in the cloud because we want to perform
|
|
|
|
54
|
|
00:23:11.320 --> 00:23:20.070
|
|
A1CE Lecture 2: effective access control. We want to make sure, right, the main objective Right.
|
|
|
|
55
|
|
00:23:20.250 --> 00:23:23.080
|
|
A1CE Lecture 2: the main… Objective.
|
|
|
|
56
|
|
00:23:25.230 --> 00:23:27.340
|
|
A1CE Lecture 2: of access control.
|
|
|
|
57
|
|
00:23:31.570 --> 00:23:36.860
|
|
A1CE Lecture 2: Is too only… Allow?
|
|
|
|
58
|
|
00:23:37.540 --> 00:23:39.460
|
|
A1CE Lecture 2: authorize…
|
|
|
|
59
|
|
00:23:45.320 --> 00:23:46.320
|
|
A1CE Lecture 2: User?
|
|
|
|
60
|
|
00:23:46.860 --> 00:23:49.770
|
|
A1CE Lecture 2: Or, it can be application.
|
|
|
|
61
|
|
00:23:54.880 --> 00:23:56.819
|
|
A1CE Lecture 2: to access.
|
|
|
|
62
|
|
00:23:58.250 --> 00:23:59.380
|
|
A1CE Lecture 2: plow?
|
|
|
|
63
|
|
00:23:59.680 --> 00:24:00.760
|
|
A1CE Lecture 2: resource.
|
|
|
|
64
|
|
00:24:10.300 --> 00:24:21.380
|
|
A1CE Lecture 2: But also, within, specific level of… Access.
|
|
|
|
65
|
|
00:24:21.720 --> 00:24:28.240
|
|
A1CE Lecture 2: So, we want to make sure that only the…
|
|
|
|
66
|
|
00:24:28.740 --> 00:24:35.930
|
|
A1CE Lecture 2: the authorized client, for example. Authorized client is… This one?
|
|
|
|
67
|
|
00:24:38.090 --> 00:24:49.610
|
|
A1CE Lecture 2: authorized clients, authorized clients, and we want to prevent, right, unauthorized access from this user.
|
|
|
|
68
|
|
00:24:51.570 --> 00:24:56.530
|
|
A1CE Lecture 2: And this user, we will prevent, right? But…
|
|
|
|
69
|
|
00:24:56.530 --> 00:25:13.800
|
|
A1CE Lecture 2: in order to access, right? It may… we can control that, okay, even this client and this client, we allow to access the resource in the cloud. We may just say that, okay, for the clean client.
|
|
|
|
70
|
|
00:25:16.200 --> 00:25:18.140
|
|
A1CE Lecture 2: It should be…
|
|
|
|
71
|
|
00:25:19.990 --> 00:25:39.700
|
|
A1CE Lecture 2: read only, right? And for us, that… maybe we are admin, right? So, for admin, we can read and write at the resource, right? So, to do… to perform access control, we want to make sure that we only
|
|
|
|
72
|
|
00:25:39.750 --> 00:25:42.069
|
|
A1CE Lecture 2: Allow. Authorize.
|
|
|
|
73
|
|
00:25:42.450 --> 00:26:01.250
|
|
A1CE Lecture 2: user to be… to be able to access the cloud resource, but within specific level of access, right? So, this is, the basic security requirement that we need to implement in the cloud, right?
|
|
|
|
74
|
|
00:26:01.590 --> 00:26:04.080
|
|
A1CE Lecture 2: But you may think, why?
|
|
|
|
75
|
|
00:26:04.440 --> 00:26:14.049
|
|
A1CE Lecture 2: why we need… why we not allow everyone to be able to access the resource? And why I say that, in some cases, you may…
|
|
|
|
76
|
|
00:26:14.190 --> 00:26:19.520
|
|
A1CE Lecture 2: possible, allow everyone to access the resource. But…
|
|
|
|
77
|
|
00:26:20.440 --> 00:26:29.280
|
|
A1CE Lecture 2: why I said that, in many cases, we don't want everyone to be able to access, right? Because,
|
|
|
|
78
|
|
00:26:30.680 --> 00:26:38.190
|
|
A1CE Lecture 2: But this is just one of the reasons, right? It's not everything, but one of the reasons
|
|
|
|
79
|
|
00:26:39.010 --> 00:26:42.260
|
|
A1CE Lecture 2: One of the reasons
|
|
|
|
80
|
|
00:26:46.240 --> 00:26:51.190
|
|
A1CE Lecture 2: That… V… Done one.
|
|
|
|
81
|
|
00:26:53.680 --> 00:26:54.660
|
|
A1CE Lecture 2: Everyone.
|
|
|
|
82
|
|
00:26:58.300 --> 00:27:00.130
|
|
A1CE Lecture 2: to access.
|
|
|
|
83
|
|
00:27:01.930 --> 00:27:03.490
|
|
A1CE Lecture 2: to cloud resource.
|
|
|
|
84
|
|
00:27:09.510 --> 00:27:12.310
|
|
A1CE Lecture 2: Can you… Can you…
|
|
|
|
85
|
|
00:27:13.080 --> 00:27:20.469
|
|
A1CE Lecture 2: Can anyone think of why… why we don't want everyone to be able to access our cloud resources?
|
|
|
|
86
|
|
00:27:24.270 --> 00:27:26.110
|
|
matt: People can just, rack up the credit.
|
|
|
|
87
|
|
00:27:26.110 --> 00:27:26.780
|
|
A1CE Lecture 2: Oh, okay.
|
|
|
|
88
|
|
00:27:27.380 --> 00:27:36.109
|
|
A1CE Lecture 2: But yeah, yeah, if, that information that we put in the cloud is,
|
|
|
|
89
|
|
00:27:36.500 --> 00:27:43.139
|
|
A1CE Lecture 2: sensitive information and contains some personal information. Yes, we don't want,
|
|
|
|
90
|
|
00:27:43.560 --> 00:27:51.830
|
|
A1CE Lecture 2: people that we not… not trust to be able to access. But if it just…
|
|
|
|
91
|
|
00:27:52.940 --> 00:27:57.670
|
|
A1CE Lecture 2: Okay, not… not sensitive information.
|
|
|
|
92
|
|
00:28:01.090 --> 00:28:06.220
|
|
A1CE Lecture 2: What is the… maybe the… the reason that we… we want to prevent?
|
|
|
|
93
|
|
00:28:10.980 --> 00:28:25.919
|
|
A1CE Lecture 2: Okay, okay, Matt, thank you. People may use the compute credit for free. Yes, in a way, yes. And also, I think, for my reason, yes, it's about cost, right? Because…
|
|
|
|
94
|
|
00:28:27.320 --> 00:28:36.759
|
|
A1CE Lecture 2: If even the service that we provide in the cloud, or the information that we put in the cloud, is…
|
|
|
|
95
|
|
00:28:36.780 --> 00:28:51.989
|
|
A1CE Lecture 2: the information that can be provided to anyone, but if many clients or many users try to read, right, try to read the data, that you, maybe you keep, maybe,
|
|
|
|
96
|
|
00:28:52.290 --> 00:29:00.449
|
|
A1CE Lecture 2: for example, because I think the last 3 days, my son just entered the national…
|
|
|
|
97
|
|
00:29:00.730 --> 00:29:12.849
|
|
A1CE Lecture 2: shares competition, and it, it, it used S3 to host, the competition result, right? So that, that is…
|
|
|
|
98
|
|
00:29:13.270 --> 00:29:20.359
|
|
A1CE Lecture 2: the competition result is… is the topic, right? Anyone can access. But…
|
|
|
|
99
|
|
00:29:20.530 --> 00:29:39.699
|
|
A1CE Lecture 2: they can do it, because I think it's only maybe not… not about thousands of people that try to access that, information, so it's not causing much, but… but, if there are a lot of requests, what gonna happen
|
|
|
|
100
|
|
00:29:39.700 --> 00:29:48.289
|
|
A1CE Lecture 2: is… maybe I just tried to choose… the data transfer. If you have… this is maybe the result, right?
|
|
|
|
101
|
|
00:29:49.060 --> 00:29:59.799
|
|
A1CE Lecture 2: And if many people try to download, we have to deliver that to the client, right? So, if this happens, is…
|
|
|
|
102
|
|
00:30:00.460 --> 00:30:04.889
|
|
A1CE Lecture 2: data transfer, right? So, for…
|
|
|
|
103
|
|
00:30:05.380 --> 00:30:09.669
|
|
A1CE Lecture 2: My son shares result? Yes, maybe?
|
|
|
|
104
|
|
00:30:11.320 --> 00:30:16.910
|
|
A1CE Lecture 2: hundreds of requests, right, to shake, and… because I'm… I never shake.
|
|
|
|
105
|
|
00:30:17.490 --> 00:30:29.029
|
|
A1CE Lecture 2: I just want to see, because there is a pairing, and it is a responsibility of the parent that I have to take my son, to the correct seat.
|
|
|
|
106
|
|
00:30:29.110 --> 00:30:40.259
|
|
A1CE Lecture 2: Right? And I have to check whether, okay, this route, my son is white inboard 2, or something like that. I have to check the website, and I just…
|
|
|
|
107
|
|
00:30:40.730 --> 00:30:56.489
|
|
A1CE Lecture 2: request for one time in the morning, and I'm just using that, right? And I never look at anything, so it's okay, it's possible, to share that to anyone, because I don't have to authenticate, or I don't have to provide
|
|
|
|
108
|
|
00:30:56.490 --> 00:31:00.900
|
|
A1CE Lecture 2: any information, and I can see, the website.
|
|
|
|
109
|
|
00:31:01.040 --> 00:31:02.540
|
|
A1CE Lecture 2: But…
|
|
|
|
110
|
|
00:31:03.010 --> 00:31:18.699
|
|
A1CE Lecture 2: In many cases, right, if there are a lot of data transfer, right, a lot of requests, I mean, millions of requests. So, the data transfer price will significantly increase.
|
|
|
|
111
|
|
00:31:18.700 --> 00:31:36.310
|
|
A1CE Lecture 2: Right? So, that… that's why it's one of the main reasons that… why is it important to provide access control? We… because we want to allow only authorized users to use our cloud resource, right? Because,
|
|
|
|
112
|
|
00:31:36.430 --> 00:31:37.740
|
|
A1CE Lecture 2: Mall?
|
|
|
|
113
|
|
00:31:38.080 --> 00:31:39.270
|
|
A1CE Lecture 2: Clough?
|
|
|
|
114
|
|
00:31:40.070 --> 00:31:41.160
|
|
A1CE Lecture 2: usage.
|
|
|
|
115
|
|
00:31:41.370 --> 00:31:49.340
|
|
A1CE Lecture 2: Right? From anyone, right? It means more cause Taboo, pay.
|
|
|
|
116
|
|
00:31:49.470 --> 00:31:51.430
|
|
A1CE Lecture 2: Right? So, this is…
|
|
|
|
117
|
|
00:31:51.700 --> 00:32:06.320
|
|
A1CE Lecture 2: why this is quite important, right? We want to make sure that we can control the access to the cloud resource that we have. And this is quite important because, it's…
|
|
|
|
118
|
|
00:32:06.610 --> 00:32:25.060
|
|
A1CE Lecture 2: I think it's the main component in any type of implementation. If you want to use the cloud as to host the website, or the web application, or you want to do the big data
|
|
|
|
119
|
|
00:32:26.280 --> 00:32:44.720
|
|
A1CE Lecture 2: big data process, right? So, create data lake, control the access for multiple types of data source. You want to work in machine learning, AI, and you also have to control, right, to perform some level of the access control. So.
|
|
|
|
120
|
|
00:32:44.970 --> 00:32:57.589
|
|
A1CE Lecture 2: in any type of implementation, access control is, I think, one of a key component that you need to understand and you apply this
|
|
|
|
121
|
|
00:32:57.600 --> 00:33:09.589
|
|
A1CE Lecture 2: knowledge to, what you will implement in any… any cloud, right? It's the same, right? So we want to make sure that we understand,
|
|
|
|
122
|
|
00:33:09.920 --> 00:33:14.779
|
|
A1CE Lecture 2: What the access control in the cloud, perform, right?
|
|
|
|
123
|
|
00:33:15.680 --> 00:33:25.119
|
|
A1CE Lecture 2: Okay, so that is why, why this, is important, and why we discussed this
|
|
|
|
124
|
|
00:33:26.470 --> 00:33:45.080
|
|
A1CE Lecture 2: for the first topic, right? Not… the first… the first way is just introduction, but for, before we talk into… talk about any topic in the cloud, I think this basic security or access control is the main thing, right? So.
|
|
|
|
125
|
|
00:33:46.050 --> 00:33:52.439
|
|
A1CE Lecture 2: we look about, what is access control, and I think Many of you met.
|
|
|
|
126
|
|
00:33:52.560 --> 00:34:04.769
|
|
A1CE Lecture 2: learning about access control already, so just a quick recap, right? For access control, there are two main components, right? The first one is…
|
|
|
|
127
|
|
00:34:05.010 --> 00:34:06.240
|
|
A1CE Lecture 2: authentication.
|
|
|
|
128
|
|
00:34:08.440 --> 00:34:17.320
|
|
A1CE Lecture 2: Right? And this is about who, right? Who is allow. Allow to access.
|
|
|
|
129
|
|
00:34:17.449 --> 00:34:18.159
|
|
A1CE Lecture 2: Right.
|
|
|
|
130
|
|
00:34:20.560 --> 00:34:24.819
|
|
A1CE Lecture 2: is about who, normally, authentication. But…
|
|
|
|
131
|
|
00:34:25.010 --> 00:34:34.710
|
|
A1CE Lecture 2: for authenticate, right? We need, basically, two things, right? It's about… Identity?
|
|
|
|
132
|
|
00:34:35.010 --> 00:34:35.710
|
|
A1CE Lecture 2: Right.
|
|
|
|
133
|
|
00:34:36.260 --> 00:34:46.989
|
|
A1CE Lecture 2: And… The thing that we use to, prove that we are this identity, which is… Queen, too, right?
|
|
|
|
134
|
|
00:34:47.170 --> 00:35:06.549
|
|
A1CE Lecture 2: So, we need the combination of identity and credential to successfully authenticate, right? To prove to the system, or prove to… before we can enter to AWS environment, that we are
|
|
|
|
135
|
|
00:35:07.530 --> 00:35:26.709
|
|
A1CE Lecture 2: the person or the user or the application that allow to access the resource, right? We need identity and credential, right? For AWS or any cloud, it's quite similar, right? There are two types of identity.
|
|
|
|
136
|
|
00:35:27.480 --> 00:35:31.700
|
|
A1CE Lecture 2: One is for long-term, right?
|
|
|
|
137
|
|
00:35:32.990 --> 00:35:36.269
|
|
A1CE Lecture 2: And other one is shuttle.
|
|
|
|
138
|
|
00:35:36.530 --> 00:35:37.220
|
|
A1CE Lecture 2: item.
|
|
|
|
139
|
|
00:35:37.320 --> 00:35:51.929
|
|
A1CE Lecture 2: So, in AWS, or I think same with other cloud, there are two types of identity. Identity that you can use long-term, and identity that you can use for short-term.
|
|
|
|
140
|
|
00:35:53.190 --> 00:35:58.669
|
|
A1CE Lecture 2: In general, for long term, normally it's the identity for
|
|
|
|
141
|
|
00:35:59.070 --> 00:36:13.519
|
|
A1CE Lecture 2: human, right? So, for us, for us to work in the cloud environment, normally we need long-term, right? We need to sign in one time, and it's work for the whole days, and we don't have to, authenticate again.
|
|
|
|
142
|
|
00:36:13.520 --> 00:36:21.059
|
|
A1CE Lecture 2: Right? Normally, when you log in to AWS environment using long-term identity, normally.
|
|
|
|
143
|
|
00:36:21.120 --> 00:36:29.729
|
|
A1CE Lecture 2: you will be able to access, AWS environment for, normally, whole days, right? And you have to attend again.
|
|
|
|
144
|
|
00:36:30.100 --> 00:36:46.280
|
|
A1CE Lecture 2: Maybe, the next day when you try to log in to AWS again, okay, that… that is when you have to authenticate again, right? And for short-term, normally it's for application, right? Because
|
|
|
|
145
|
|
00:36:46.410 --> 00:36:55.840
|
|
A1CE Lecture 2: when some applications want to access AWS service, we may provide just shutter, because
|
|
|
|
146
|
|
00:36:56.770 --> 00:36:59.800
|
|
A1CE Lecture 2: This is the application, so anyone can…
|
|
|
|
147
|
|
00:37:00.300 --> 00:37:07.980
|
|
A1CE Lecture 2: anyone can access, or anyone can request to access AWS service, because, yeah.
|
|
|
|
148
|
|
00:37:08.230 --> 00:37:23.410
|
|
A1CE Lecture 2: to access AWS, you can come from any… anywhere from in the internet, and you can try to access the cloud resource, right? So, for application or service that you deploy, and you may need to access
|
|
|
|
149
|
|
00:37:23.410 --> 00:37:31.150
|
|
A1CE Lecture 2: some service in the cloud, we may provide something like short-term identity to just
|
|
|
|
150
|
|
00:37:31.150 --> 00:37:43.610
|
|
A1CE Lecture 2: authentication for this request, right? And if you want to access again, you have to authenticate again, right? Because it's a machine. We want to,
|
|
|
|
151
|
|
00:37:43.800 --> 00:37:48.389
|
|
A1CE Lecture 2: to authenticate every request, right? Because…
|
|
|
|
152
|
|
00:37:49.130 --> 00:37:59.740
|
|
A1CE Lecture 2: It's more… if in terms of identity and also credential, credentials also have the same thing that we… because if you use long-term identity.
|
|
|
|
153
|
|
00:37:59.860 --> 00:38:10.980
|
|
A1CE Lecture 2: We also have to pair with long-term credential, and if you use short-term identity, and you work with short-term credential.
|
|
|
|
154
|
|
00:38:11.030 --> 00:38:30.410
|
|
A1CE Lecture 2: Right? So, it's just something like per request, right? One request, you authenticate. And if you want to access again, you just have to authenticate again, because what you use is the short-term identity and also short-term credential, and you have to authenticate per request, right?
|
|
|
|
155
|
|
00:38:30.410 --> 00:38:33.720
|
|
A1CE Lecture 2: And… If you want more security.
|
|
|
|
156
|
|
00:38:33.920 --> 00:38:42.379
|
|
A1CE Lecture 2: If the security is much more, strict, or you want high level of security.
|
|
|
|
157
|
|
00:38:42.790 --> 00:38:52.330
|
|
A1CE Lecture 2: short-term, right? Short-term identity and short-term credential is, preferred, right? But… is, is…
|
|
|
|
158
|
|
00:38:52.500 --> 00:38:57.869
|
|
A1CE Lecture 2: similar to anything, if you try to say that.
|
|
|
|
159
|
|
00:38:58.050 --> 00:39:04.350
|
|
A1CE Lecture 2: Short-term identity and short-term credential is preferred, because it's more secure, because
|
|
|
|
160
|
|
00:39:04.740 --> 00:39:24.310
|
|
A1CE Lecture 2: if you… you cannot reuse, you… you cannot just, if the credential is compromised, if it is short-term, right? If the credential is compromised, it may expire in 1 hour, it can expire in 4 hours. So…
|
|
|
|
161
|
|
00:39:24.740 --> 00:39:31.649
|
|
A1CE Lecture 2: The compromise of credential may not significantly,
|
|
|
|
162
|
|
00:39:31.770 --> 00:39:44.469
|
|
A1CE Lecture 2: create much damage to the system, right? Because the credential will be expired in really short period of time, right? But it will be difficult to manage, because
|
|
|
|
163
|
|
00:39:44.590 --> 00:39:58.680
|
|
A1CE Lecture 2: if you use short-term identity and short-term credential, so it's a lot of credential that you have to manage, right? So you need something to… to help you effectively manage.
|
|
|
|
164
|
|
00:39:58.750 --> 00:40:08.300
|
|
A1CE Lecture 2: the short-term current year. So, that… that is something, like, trade-off that I think for… In any engineering.
|
|
|
|
165
|
|
00:40:08.960 --> 00:40:14.149
|
|
A1CE Lecture 2: Topic. We have to face in about how we can trade off.
|
|
|
|
166
|
|
00:40:14.470 --> 00:40:23.889
|
|
A1CE Lecture 2: Because when we… when we get something, if we get benefit from something, it will create some drawback.
|
|
|
|
167
|
|
00:40:24.030 --> 00:40:29.710
|
|
A1CE Lecture 2: That we need to make sure that we balance the threat of Right.
|
|
|
|
168
|
|
00:40:29.930 --> 00:40:41.730
|
|
A1CE Lecture 2: Right? Because this is one of the examples. Yeah, short-term credential, short-term identity is better in terms of security, but you have to work with a lot of
|
|
|
|
169
|
|
00:40:41.950 --> 00:40:53.300
|
|
A1CE Lecture 2: Credential, and how we make sure that we can effectively manage this is something that we have to, need to take into the consideration.
|
|
|
|
170
|
|
00:40:54.000 --> 00:41:08.170
|
|
A1CE Lecture 2: Okay, so this is authentication, right? So, we know about long-term and also short-term, right? And the next thing is, the second part, but this only happened
|
|
|
|
171
|
|
00:41:08.830 --> 00:41:21.030
|
|
A1CE Lecture 2: After… you successfully authenticate, right? When you successfully authenticate, you can go to the next, step, is authorization.
|
|
|
|
172
|
|
00:41:27.810 --> 00:41:34.940
|
|
A1CE Lecture 2: Okay. For authorization is about which Level?
|
|
|
|
173
|
|
00:41:35.440 --> 00:41:37.820
|
|
A1CE Lecture 2: of… Access.
|
|
|
|
174
|
|
00:41:41.170 --> 00:41:46.840
|
|
A1CE Lecture 2: Is allow, right?
|
|
|
|
175
|
|
00:41:47.470 --> 00:41:57.119
|
|
A1CE Lecture 2: Okay, so authorization is, okay, if you are authenticated user, you can access the resource, but you can access the resource as
|
|
|
|
176
|
|
00:41:57.260 --> 00:42:07.839
|
|
A1CE Lecture 2: Which level, and… Which level, or… and also, which… resource, right? So…
|
|
|
|
177
|
|
00:42:08.470 --> 00:42:20.619
|
|
A1CE Lecture 2: how many resources that you can access, and at which level, right? So this is authorization. So normally it's in the form of…
|
|
|
|
178
|
|
00:42:20.810 --> 00:42:28.930
|
|
A1CE Lecture 2: policy, right? It's about the policy that allows All. Deny.
|
|
|
|
179
|
|
00:42:30.000 --> 00:42:31.060
|
|
A1CE Lecture 2: Access.
|
|
|
|
180
|
|
00:42:32.560 --> 00:42:42.510
|
|
A1CE Lecture 2: 2… wish… resource… And… level.
|
|
|
|
181
|
|
00:42:44.260 --> 00:42:46.639
|
|
A1CE Lecture 2: of access, right?
|
|
|
|
182
|
|
00:42:46.820 --> 00:42:56.739
|
|
A1CE Lecture 2: So, the policy will be mapping with identity, so any identity That is authenticated, right?
|
|
|
|
183
|
|
00:42:57.230 --> 00:42:58.460
|
|
A1CE Lecture 2: Authenticate.
|
|
|
|
184
|
|
00:43:00.140 --> 00:43:09.469
|
|
A1CE Lecture 2: Identity must be mapping with policy, right? So, when you've, successfully authenticated.
|
|
|
|
185
|
|
00:43:09.650 --> 00:43:14.030
|
|
A1CE Lecture 2: It will be checked that, okay, this user is authenticated, right?
|
|
|
|
186
|
|
00:43:14.300 --> 00:43:28.599
|
|
A1CE Lecture 2: and authorized. But which level of this user can access the resource is specified in the policy that will attach to that identity, right? So it will provide
|
|
|
|
187
|
|
00:43:29.310 --> 00:43:36.239
|
|
A1CE Lecture 2: The effect, which is allow or deny, right? And allow or deny to access
|
|
|
|
188
|
|
00:43:37.170 --> 00:43:43.259
|
|
A1CE Lecture 2: how many resources? It can be one resource, it can be two resources, three resources, or
|
|
|
|
189
|
|
00:43:43.810 --> 00:43:48.440
|
|
A1CE Lecture 2: At what level of access that it will be allowed.
|
|
|
|
190
|
|
00:43:48.780 --> 00:43:51.789
|
|
A1CE Lecture 2: Right? Levi always says, normally, it's read.
|
|
|
|
191
|
|
00:43:51.900 --> 00:43:55.080
|
|
A1CE Lecture 2: With only or full access is to break right.
|
|
|
|
192
|
|
00:43:55.200 --> 00:43:55.880
|
|
A1CE Lecture 2: Right.
|
|
|
|
193
|
|
00:43:56.350 --> 00:44:07.220
|
|
A1CE Lecture 2: So, this is authorization, right? And how it… how AWS and also other cloud providers implement this access control.
|
|
|
|
194
|
|
00:44:07.670 --> 00:44:12.609
|
|
A1CE Lecture 2: It will be implemented.
|
|
|
|
195
|
|
00:44:14.720 --> 00:44:15.570
|
|
A1CE Lecture 2: Matis nich.
|
|
|
|
196
|
|
00:44:15.690 --> 00:44:17.079
|
|
A1CE Lecture 2: Maybe not this color.
|
|
|
|
197
|
|
00:44:17.430 --> 00:44:30.250
|
|
A1CE Lecture 2: It will be implemented before you can access AWS or any cloud environment, because all cloud providers, you can access by…
|
|
|
|
198
|
|
00:44:31.820 --> 00:44:45.800
|
|
A1CE Lecture 2: connect to AWS API, Google Cloud API, Microsoft Azure API, and at that AWS API, or any Cloud API, the access control is implemented
|
|
|
|
199
|
|
00:44:46.690 --> 00:44:53.460
|
|
A1CE Lecture 2: at this API, right? Before the request from the client can
|
|
|
|
200
|
|
00:44:53.600 --> 00:45:13.370
|
|
A1CE Lecture 2: be sent to the resource in the cloud, right? It have to pass through the cloud API first. So, this is when… this is where the access control is implemented, is at the API of the cloud, right? And the process for,
|
|
|
|
201
|
|
00:45:13.580 --> 00:45:23.380
|
|
A1CE Lecture 2: access control in many cloud providers, AWS and TCP using the same name, is identity and access management.
|
|
|
|
202
|
|
00:45:23.560 --> 00:45:29.800
|
|
A1CE Lecture 2: In short, I call IAM, right? So… When you look at
|
|
|
|
203
|
|
00:45:30.840 --> 00:45:42.129
|
|
A1CE Lecture 2: Access control in the cloud, normally, this is, okay, for AWS, the name is… for the service is Identity, right?
|
|
|
|
204
|
|
00:45:42.720 --> 00:45:46.490
|
|
A1CE Lecture 2: identity and… Access management.
|
|
|
|
205
|
|
00:45:51.530 --> 00:45:58.489
|
|
A1CE Lecture 2: Or, in short, is IAM, or IAM, right? Identity and Access Management.
|
|
|
|
206
|
|
00:45:59.700 --> 00:46:10.200
|
|
A1CE Lecture 2: Okay, so it is quite, simple, because if you look at identity, yes, identity is authentic, right?
|
|
|
|
207
|
|
00:46:10.900 --> 00:46:15.050
|
|
A1CE Lecture 2: And access management, yes, this is authorization.
|
|
|
|
208
|
|
00:46:15.540 --> 00:46:24.169
|
|
A1CE Lecture 2: So, identity and access management, is about access control. It's about authenticate and authorization.
|
|
|
|
209
|
|
00:46:24.280 --> 00:46:32.620
|
|
A1CE Lecture 2: So… Right now, we will be talking about IAM, in AWS.
|
|
|
|
210
|
|
00:46:33.750 --> 00:46:40.229
|
|
A1CE Lecture 2: So, the first thing is we're talking about, identity first, right?
|
|
|
|
211
|
|
00:46:41.020 --> 00:46:45.380
|
|
A1CE Lecture 2: Identity, that… AWS.
|
|
|
|
212
|
|
00:46:45.840 --> 00:46:46.750
|
|
A1CE Lecture 2: support.
|
|
|
|
213
|
|
00:46:46.980 --> 00:46:47.670
|
|
A1CE Lecture 2: Bye.
|
|
|
|
214
|
|
00:46:49.010 --> 00:47:00.790
|
|
A1CE Lecture 2: there's multiple identity that sub-AWS support. It means you can use that in AWS environment, right? The first one is…
|
|
|
|
215
|
|
00:47:02.570 --> 00:47:03.850
|
|
A1CE Lecture 2: I am using.
|
|
|
|
216
|
|
00:47:04.530 --> 00:47:05.260
|
|
A1CE Lecture 2: Right?
|
|
|
|
217
|
|
00:47:05.530 --> 00:47:11.570
|
|
A1CE Lecture 2: The second one… is… I am… role.
|
|
|
|
218
|
|
00:47:11.910 --> 00:47:12.620
|
|
A1CE Lecture 2: Bye.
|
|
|
|
219
|
|
00:47:13.190 --> 00:47:19.409
|
|
A1CE Lecture 2: And the third one is also from the IAM, is IAM…
|
|
|
|
220
|
|
00:47:19.660 --> 00:47:24.960
|
|
A1CE Lecture 2: And right now, they're using the name Iam User Group.
|
|
|
|
221
|
|
00:47:25.420 --> 00:47:31.059
|
|
A1CE Lecture 2: Right. So, identity… That you can create.
|
|
|
|
222
|
|
00:47:31.260 --> 00:47:42.429
|
|
A1CE Lecture 2: And manage in… identity and access management in AWS is you have 3 types of identity. I am user.
|
|
|
|
223
|
|
00:47:42.880 --> 00:47:48.620
|
|
A1CE Lecture 2: I am role, and I am user group, right? You can create
|
|
|
|
224
|
|
00:47:48.680 --> 00:48:04.449
|
|
A1CE Lecture 2: delete, modify, or anything, right, that's possible in identity and access management in AWS. This is the three local identity that you can create in
|
|
|
|
225
|
|
00:48:04.530 --> 00:48:08.030
|
|
A1CE Lecture 2: the IAM service in AWS, and
|
|
|
|
226
|
|
00:48:08.140 --> 00:48:14.380
|
|
A1CE Lecture 2: This is not… for AWS, it's not many services, but I am in AWS is…
|
|
|
|
227
|
|
00:48:15.090 --> 00:48:23.539
|
|
A1CE Lecture 2: global service, right? What it means here is you can create IAM user.
|
|
|
|
228
|
|
00:48:23.660 --> 00:48:31.939
|
|
A1CE Lecture 2: And you can then use that IAM user with The service in every region.
|
|
|
|
229
|
|
00:48:32.330 --> 00:48:48.330
|
|
A1CE Lecture 2: in your AWS account, right? Because it's a global service. You set one time, and you can use that identity in any region that AWS has right now, right? It's global service.
|
|
|
|
230
|
|
00:48:49.680 --> 00:48:59.970
|
|
A1CE Lecture 2: But AWS not only supports the local identity that you can create in IAM, the fourth identity.
|
|
|
|
231
|
|
00:49:00.160 --> 00:49:05.870
|
|
A1CE Lecture 2: That you can use is… Federet.
|
|
|
|
232
|
|
00:49:06.190 --> 00:49:07.690
|
|
A1CE Lecture 2: user, I think.
|
|
|
|
233
|
|
00:49:07.800 --> 00:49:14.249
|
|
A1CE Lecture 2: So, what… what is federate user, right? Federate user is mean the…
|
|
|
|
234
|
|
00:49:15.020 --> 00:49:26.839
|
|
A1CE Lecture 2: the identity that's in the domain that is outside AWS, right? I just provide you some…
|
|
|
|
235
|
|
00:49:28.070 --> 00:49:40.190
|
|
A1CE Lecture 2: if you have AWS here, and you have IAM, which is a global process that you can create anything inside AWS environment, but
|
|
|
|
236
|
|
00:49:40.340 --> 00:49:50.840
|
|
A1CE Lecture 2: If, for example, if I manage, AWS environment in my school of IT, right, I don't want,
|
|
|
|
237
|
|
00:49:51.370 --> 00:50:02.320
|
|
A1CE Lecture 2: any stuff to… to have two identity, right? Because if I… so, for example, if I am… in…
|
|
|
|
238
|
|
00:50:02.560 --> 00:50:10.049
|
|
A1CE Lecture 2: okay, not faculty, not school of IT, maybe… I'm also, in KMIT Highline.
|
|
|
|
239
|
|
00:50:10.740 --> 00:50:16.579
|
|
A1CE Lecture 2: So I have a domain, I have email, right? The part.pr.
|
|
|
|
240
|
|
00:50:16.730 --> 00:50:18.660
|
|
A1CE Lecture 2: at KMATL.
|
|
|
|
241
|
|
00:50:19.140 --> 00:50:27.720
|
|
A1CE Lecture 2: ac.ch, right? So, if I don't connect my…
|
|
|
|
242
|
|
00:50:27.950 --> 00:50:45.950
|
|
A1CE Lecture 2: identity domain in KMITL, and I have to work with AWS, which is right now. I also have one account, right? And I have one account that I can use to access AWS, right? So I… right now, I use,
|
|
|
|
243
|
|
00:50:46.130 --> 00:50:52.399
|
|
A1CE Lecture 2: For example, Lapad at… Test.com.
|
|
|
|
244
|
|
00:50:53.120 --> 00:51:05.519
|
|
A1CE Lecture 2: just examples, right? So, if I not connect, when I want to work with AWS, I have to log in with lapart at test.com, and I have credential for that to access AWS.
|
|
|
|
245
|
|
00:51:05.590 --> 00:51:22.100
|
|
A1CE Lecture 2: And when I work with KMITL environment, I use labhat.pr at kmitr.ac.th to access KMITL service, right? But if I want, right, to work in AWS environment, but I just want
|
|
|
|
246
|
|
00:51:22.180 --> 00:51:31.819
|
|
A1CE Lecture 2: to only have one identity, and this one identity can be used to access KMIGL, and also
|
|
|
|
247
|
|
00:51:31.840 --> 00:51:49.789
|
|
A1CE Lecture 2: can use to access AWS environment by using the same identity and credential, right? Which is something like, if I can say, single sign-on, right? You can do that, right? But, the detail, if you want to know.
|
|
|
|
248
|
|
00:51:49.900 --> 00:51:54.879
|
|
A1CE Lecture 2: I can provide the link or information, so I will provide the link
|
|
|
|
249
|
|
00:51:55.110 --> 00:52:08.139
|
|
A1CE Lecture 2: to work with how, how you can set up that, that you want to perform single sign-on, to AWS environment using federal identity provider. So.
|
|
|
|
250
|
|
00:52:08.530 --> 00:52:19.229
|
|
A1CE Lecture 2: that's their step that can help you to set up, or AWS also have some service that can help you, to set up
|
|
|
|
251
|
|
00:52:19.520 --> 00:52:35.920
|
|
A1CE Lecture 2: this kind of, requirement that you want, but the main idea is actually you just register, right? You have to connect, right? If the KMATL domain, is Active Directory, I just don'
|
|
|
|
252
|
|
00:52:36.430 --> 00:52:45.820
|
|
A1CE Lecture 2: I have to connect, right? Set up my IAM in my AWS account to know that, okay, this is…
|
|
|
|
253
|
|
00:52:46.010 --> 00:53:00.630
|
|
A1CE Lecture 2: Federate, identity domain, right? IDP, another IDP outside is Active Directory, and I set up that my identity and access management in my AWS account know about
|
|
|
|
254
|
|
00:53:01.630 --> 00:53:11.860
|
|
A1CE Lecture 2: the identity provider in KMITF, right? So, when I try to log in to AWS using this
|
|
|
|
255
|
|
00:53:12.140 --> 00:53:15.860
|
|
A1CE Lecture 2: identity for the MITR, so I can send
|
|
|
|
256
|
|
00:53:16.180 --> 00:53:33.669
|
|
A1CE Lecture 2: My identity, which is my email, and also credential is password, right? I will submit to AWS, right? And the IAM of my account in AWS will send that identity and credential to check with PMIL.
|
|
|
|
257
|
|
00:53:33.910 --> 00:53:35.190
|
|
A1CE Lecture 2: Hi there, AD Silva.
|
|
|
|
258
|
|
00:53:35.610 --> 00:53:38.819
|
|
A1CE Lecture 2: And if KMIT have said that, okay.
|
|
|
|
259
|
|
00:53:39.060 --> 00:53:44.210
|
|
A1CE Lecture 2: There's a correct hi, Daddy, nice to meet you.
|
|
|
|
260
|
|
00:53:44.550 --> 00:53:50.690
|
|
A1CE Lecture 2: I am in the base to say, okay, this is authenticated, right? Successfully authenticated, and…
|
|
|
|
261
|
|
00:53:50.920 --> 00:53:55.039
|
|
A1CE Lecture 2: I can allow these users to access the education.
|
|
|
|
262
|
|
00:53:55.510 --> 00:54:04.740
|
|
A1CE Lecture 2: So, if you enter database, You can both… you can come from… another…
|
|
|
|
263
|
|
00:54:05.380 --> 00:54:09.630
|
|
A1CE Lecture 2: identity provider, right? If you come from an identity provider.
|
|
|
|
264
|
|
00:54:09.740 --> 00:54:12.740
|
|
A1CE Lecture 2: you are using Federate using. Oh.
|
|
|
|
265
|
|
00:54:13.630 --> 00:54:17.130
|
|
A1CE Lecture 2: Okay, the audio quality went down.
|
|
|
|
266
|
|
00:54:23.440 --> 00:54:27.360
|
|
A1CE Lecture 2: just… I think the pathway?
|
|
|
|
267
|
|
00:54:31.300 --> 00:54:35.649
|
|
A1CE Lecture 2: Okay, this… is it… it is better?
|
|
|
|
268
|
|
00:54:36.480 --> 00:54:38.470
|
|
A1CE Lecture 2: Or you not hear anything.
|
|
|
|
269
|
|
00:54:38.760 --> 00:54:41.419
|
|
A1CE Lecture 2: Okay, you can hear now?
|
|
|
|
270
|
|
00:54:41.660 --> 00:54:42.510
|
|
A1CE Lecture 2: Okay.
|
|
|
|
271
|
|
00:54:43.610 --> 00:54:46.410
|
|
A1CE Lecture 2: Okay, I chained a microphone, so…
|
|
|
|
272
|
|
00:54:46.650 --> 00:54:54.319
|
|
A1CE Lecture 2: Thank you very much. If you have a problem with the audio quality, just send… send in the chat, right?
|
|
|
|
273
|
|
00:54:54.440 --> 00:54:55.260
|
|
A1CE Lecture 2: Thank you.
|
|
|
|
274
|
|
00:54:55.450 --> 00:54:57.140
|
|
A1CE Lecture 2: Okay, so…
|
|
|
|
275
|
|
00:55:00.310 --> 00:55:06.049
|
|
A1CE Lecture 2: If… Okay, this is, for federate user, right?
|
|
|
|
276
|
|
00:55:06.410 --> 00:55:10.770
|
|
A1CE Lecture 2: And another… Identity, right?
|
|
|
|
277
|
|
00:55:10.900 --> 00:55:21.679
|
|
A1CE Lecture 2: Another identity is… AWS, echo… producer, right?
|
|
|
|
278
|
|
00:55:22.090 --> 00:55:34.910
|
|
A1CE Lecture 2: So, in this case, it means because in order to use AWS, we can use local identity that you create in IAM, or if I am the account owner.
|
|
|
|
279
|
|
00:55:34.930 --> 00:55:54.089
|
|
A1CE Lecture 2: when… when we… when I apply for AWS account, I have to provide my email, and I create a password, and I validate my credit card, right? So, I can log into AWS Environment using my AWS account producer, which is…
|
|
|
|
280
|
|
00:55:54.340 --> 00:56:05.789
|
|
A1CE Lecture 2: is something like Super User. You can do everything, by using AWS account user. It's just like, you, when you authenticate.
|
|
|
|
281
|
|
00:56:06.540 --> 00:56:13.360
|
|
A1CE Lecture 2: the… authorization is… you can do everything, right? There's no policy…
|
|
|
|
282
|
|
00:56:13.520 --> 00:56:21.079
|
|
A1CE Lecture 2: mapping with AWS account reducer, but it's actually a policy, right? But policy that
|
|
|
|
283
|
|
00:56:21.080 --> 00:56:38.560
|
|
A1CE Lecture 2: you can do everything, right? You are the, just like, the god in this, AWS account, because you are a load user, right? So, for AWS recommendation, you need to use, AWS account load user.
|
|
|
|
284
|
|
00:56:38.590 --> 00:56:51.380
|
|
A1CE Lecture 2: only when it is required, right? You don't want to use ADB as a cow reducer to do anything. Do everything, every day, right? Because, because
|
|
|
|
285
|
|
00:56:51.800 --> 00:56:58.079
|
|
A1CE Lecture 2: It… it's just, like, super user, it can do anything, but if it's compromised.
|
|
|
|
286
|
|
00:56:58.190 --> 00:57:00.509
|
|
A1CE Lecture 2: It's gonna be, various…
|
|
|
|
287
|
|
00:57:00.610 --> 00:57:17.559
|
|
A1CE Lecture 2: serious problem, right? Because it's just like, you… you provide the key to the hacker, and if you… the hacker can get your credential of your AWS account reducer, they can do everything, right? They can chain permission, they can…
|
|
|
|
288
|
|
00:57:17.660 --> 00:57:23.930
|
|
A1CE Lecture 2: even close the account, right? It's… it's very,
|
|
|
|
289
|
|
00:57:24.490 --> 00:57:31.729
|
|
A1CE Lecture 2: But it's one of the identity that you can use in AWS, right? AWS account reducer, but use it
|
|
|
|
290
|
|
00:57:32.600 --> 00:57:37.700
|
|
A1CE Lecture 2: when it is required, right? Only. Normally, for day-to-day operation.
|
|
|
|
291
|
|
00:57:37.860 --> 00:57:50.559
|
|
A1CE Lecture 2: just create IAM user and SI Policy as the admin to that IAM user, and using that for day-to-day operation, instead of using AWS account root user, right?
|
|
|
|
292
|
|
00:57:51.000 --> 00:57:53.960
|
|
A1CE Lecture 2: And the last one, right?
|
|
|
|
293
|
|
00:57:54.220 --> 00:58:02.650
|
|
A1CE Lecture 2: Further reducer, AWS account, reducer, and the last one is AWS, Service.
|
|
|
|
294
|
|
00:58:03.080 --> 00:58:09.309
|
|
A1CE Lecture 2: Right? You may think, why AWS service is also identity in AWS?
|
|
|
|
295
|
|
00:58:10.880 --> 00:58:17.020
|
|
A1CE Lecture 2: I just go back to this, right? So, if you have…
|
|
|
|
296
|
|
00:58:17.230 --> 00:58:29.639
|
|
A1CE Lecture 2: storage, right? S3 bucket, and you have virtual machine, right? And you want to read the data that you keep in this storage, and download that
|
|
|
|
297
|
|
00:58:29.960 --> 00:58:32.189
|
|
A1CE Lecture 2: Data to this virtual machine.
|
|
|
|
298
|
|
00:58:32.300 --> 00:58:39.120
|
|
A1CE Lecture 2: You cannot… connect from VM to the storage directly?
|
|
|
|
299
|
|
00:58:39.260 --> 00:58:43.859
|
|
A1CE Lecture 2: The VM service in AWS Core,
|
|
|
|
300
|
|
00:58:44.190 --> 00:58:46.519
|
|
A1CE Lecture 2: I just used the correct name, right?
|
|
|
|
301
|
|
00:58:46.770 --> 00:58:57.349
|
|
A1CE Lecture 2: But virtual machine service in the West is called EC2, right? So, if you want to download the file from storage, it's 3 buckets to the EC2 instance.
|
|
|
|
302
|
|
00:58:58.210 --> 00:59:04.520
|
|
A1CE Lecture 2: Easy tool must be able to… must authenticate.
|
|
|
|
303
|
|
00:59:04.660 --> 00:59:13.439
|
|
A1CE Lecture 2: to the AWS API first. And if they successfully authenticated, It will get the…
|
|
|
|
304
|
|
00:59:13.660 --> 00:59:21.549
|
|
A1CE Lecture 2: the authorization to be able to download the file form, the S3 bucket, right? So.
|
|
|
|
305
|
|
00:59:22.030 --> 00:59:31.999
|
|
A1CE Lecture 2: EC2 or AWS service must authenticate and authorized with AWS API. So, AWS service.
|
|
|
|
306
|
|
00:59:32.710 --> 00:59:36.450
|
|
A1CE Lecture 2: can be… One of identity.
|
|
|
|
307
|
|
00:59:36.620 --> 00:59:48.530
|
|
A1CE Lecture 2: that can, using all requests to AWS API. So, for AWS environment, these are 6
|
|
|
|
308
|
|
00:59:49.690 --> 00:59:58.849
|
|
A1CE Lecture 2: identity that you can use to work with AWS environment, right? So, what is mean?
|
|
|
|
309
|
|
00:59:59.300 --> 01:00:03.169
|
|
A1CE Lecture 2: Here is, if you don't want to set up another domain.
|
|
|
|
310
|
|
01:00:03.440 --> 01:00:12.629
|
|
A1CE Lecture 2: Yeah, what you can use is, you can use IAM user, you can use IAM role, you can use AWS account root user, or
|
|
|
|
311
|
|
01:00:12.880 --> 01:00:28.710
|
|
A1CE Lecture 2: you are AWS service in your account, and want to access another AWS service that's also in your account, right? So, these are only, options for identity in AWS environment, right?
|
|
|
|
312
|
|
01:00:28.830 --> 01:00:29.760
|
|
A1CE Lecture 2: But…
|
|
|
|
313
|
|
01:00:33.800 --> 01:00:40.779
|
|
A1CE Lecture 2: One of the identity, cannot send requests to AWS API. Is…
|
|
|
|
314
|
|
01:00:43.980 --> 01:00:46.119
|
|
A1CE Lecture 2: I am user group.
|
|
|
|
315
|
|
01:00:46.380 --> 01:00:47.100
|
|
A1CE Lecture 2: Bye.
|
|
|
|
316
|
|
01:00:48.350 --> 01:00:58.940
|
|
A1CE Lecture 2: This one is, cannot send requests to the AWS API. Its core is not principle.
|
|
|
|
317
|
|
01:00:59.280 --> 01:01:00.120
|
|
A1CE Lecture 2: Bye.
|
|
|
|
318
|
|
01:01:00.260 --> 01:01:08.719
|
|
A1CE Lecture 2: All other identity is principle in AWS, right? I have to say that what is principle?
|
|
|
|
319
|
|
01:01:09.560 --> 01:01:18.570
|
|
A1CE Lecture 2: Principle in AWS is identity, That. Can… Sen?
|
|
|
|
320
|
|
01:01:19.090 --> 01:01:26.959
|
|
A1CE Lecture 2: request, to AWS API, right? So…
|
|
|
|
321
|
|
01:01:28.470 --> 01:01:32.389
|
|
A1CE Lecture 2: There are 6 identities that it will support.
|
|
|
|
322
|
|
01:01:32.490 --> 01:01:51.070
|
|
A1CE Lecture 2: Only one identity that is not principal is IAM user group. So, you can use IAM user, you can use IAM role, you can use federate User, you can use AWS account route user, or you are AWS service, right? All of these five identities
|
|
|
|
323
|
|
01:01:51.390 --> 01:01:59.309
|
|
A1CE Lecture 2: are principle, right? So, it is the identity that can send requests to AWS API.
|
|
|
|
324
|
|
01:01:59.680 --> 01:02:10.730
|
|
A1CE Lecture 2: And for the definition of principle, you also will see this in Google Cloud, and Google Cloud also said that this is principle.
|
|
|
|
325
|
|
01:02:11.060 --> 01:02:22.839
|
|
A1CE Lecture 2: And the meaning is the same, right? So, principle in Google Cloud and principle in AWS meaning the same thing. It's mean identity that can send requests to AWS API.
|
|
|
|
326
|
|
01:02:22.990 --> 01:02:24.520
|
|
A1CE Lecture 2: Same, right?
|
|
|
|
327
|
|
01:02:24.750 --> 01:02:30.050
|
|
A1CE Lecture 2: And I think for Google Cloud is also the same.
|
|
|
|
328
|
|
01:02:31.090 --> 01:02:37.099
|
|
A1CE Lecture 2: There are multiple types of identity that you can use in Google Cloud, but the name
|
|
|
|
329
|
|
01:02:37.980 --> 01:02:46.959
|
|
A1CE Lecture 2: it's gonna be a little bit different, right, for Google Cloud, and if some of you used Google Cloud before, you may think, hmm.
|
|
|
|
330
|
|
01:02:47.160 --> 01:02:49.079
|
|
A1CE Lecture 2: I am Ro.
|
|
|
|
331
|
|
01:02:49.280 --> 01:02:54.369
|
|
A1CE Lecture 2: Right? IAM role in AWS is identity, right? But…
|
|
|
|
332
|
|
01:02:55.040 --> 01:02:59.070
|
|
A1CE Lecture 2: I am Ro, if you used Google Cloud before. I am Ro.
|
|
|
|
333
|
|
01:02:59.450 --> 01:03:08.880
|
|
A1CE Lecture 2: in GCP, equal to… I am… policy in AWS.
|
|
|
|
334
|
|
01:03:10.130 --> 01:03:21.299
|
|
A1CE Lecture 2: So, this is something that, if you work with two cloud providers, this one is the first thing that you will be a little bit confused, because
|
|
|
|
335
|
|
01:03:21.500 --> 01:03:23.570
|
|
A1CE Lecture 2: It is the same name.
|
|
|
|
336
|
|
01:03:23.790 --> 01:03:26.740
|
|
A1CE Lecture 2: But the meaning is differenti.
|
|
|
|
337
|
|
01:03:26.890 --> 01:03:29.680
|
|
A1CE Lecture 2: Right? So, for AWS,
|
|
|
|
338
|
|
01:03:30.050 --> 01:03:44.199
|
|
A1CE Lecture 2: IM role is identity, right? And if you remember, I said about long-term and short-term, right? If you want to use long-term, right? Long-term identity.
|
|
|
|
339
|
|
01:03:44.400 --> 01:03:46.740
|
|
A1CE Lecture 2: IAM user is long-term.
|
|
|
|
340
|
|
01:03:48.850 --> 01:03:50.749
|
|
A1CE Lecture 2: It's long-term identity.
|
|
|
|
341
|
|
01:03:50.890 --> 01:03:59.080
|
|
A1CE Lecture 2: And, for sure, if IAM user is long-term, IAM low is for short-term.
|
|
|
|
342
|
|
01:03:59.740 --> 01:04:00.820
|
|
A1CE Lecture 2: Identity.
|
|
|
|
343
|
|
01:04:02.240 --> 01:04:02.940
|
|
A1CE Lecture 2: Bye.
|
|
|
|
344
|
|
01:04:03.650 --> 01:04:14.209
|
|
A1CE Lecture 2: So, AWS identity for different type of users. IAM user, long-term, right? IAM role, short-term, right?
|
|
|
|
345
|
|
01:04:14.360 --> 01:04:18.520
|
|
A1CE Lecture 2: And… for AWS service.
|
|
|
|
346
|
|
01:04:19.490 --> 01:04:27.679
|
|
A1CE Lecture 2: Right? So… I say that AWS service is identity that can
|
|
|
|
347
|
|
01:04:27.700 --> 01:04:41.650
|
|
A1CE Lecture 2: access that can send requests to the AWS API, to grant the access to another AWS service. And EC2 is, or any AWS resource, normally.
|
|
|
|
348
|
|
01:04:41.660 --> 01:04:51.410
|
|
A1CE Lecture 2: you have to assume, right, how easy you can authenticate with AWS API is assume
|
|
|
|
349
|
|
01:04:51.800 --> 01:04:56.939
|
|
A1CE Lecture 2: role, right? So, when AWS service wants to…
|
|
|
|
350
|
|
01:04:59.880 --> 01:05:10.320
|
|
A1CE Lecture 2: connect or access another AWS service, you have to create IAM role, right? IAM role will attach with IAM policy, right?
|
|
|
|
351
|
|
01:05:10.480 --> 01:05:18.999
|
|
A1CE Lecture 2: And… to assume role, it means when EC2 want to access S3 bucket?
|
|
|
|
352
|
|
01:05:19.330 --> 01:05:20.890
|
|
A1CE Lecture 2: Easy to view.
|
|
|
|
353
|
|
01:05:21.340 --> 01:05:30.020
|
|
A1CE Lecture 2: send requests to AWS API and tell AWS API that I am attached with this IAM role.
|
|
|
|
354
|
|
01:05:30.570 --> 01:05:37.540
|
|
A1CE Lecture 2: So… API will check, okay, and the policy that's attached to this
|
|
|
|
355
|
|
01:05:37.690 --> 01:05:48.240
|
|
A1CE Lecture 2: IAM rule allowed to exit S3 or not. If it allows, it will say, okay, you can exit S3. And…
|
|
|
|
356
|
|
01:05:48.750 --> 01:06:00.710
|
|
A1CE Lecture 2: EC2 can download or upload file to the S3 bucket, right? But if the EC2 want to access S3 again for the second time.
|
|
|
|
357
|
|
01:06:00.890 --> 01:06:13.779
|
|
A1CE Lecture 2: it has to authenticate again, because EC2 using IAM role to authenticate and authorize with AWS API? And IAM role is
|
|
|
|
358
|
|
01:06:14.050 --> 01:06:15.340
|
|
A1CE Lecture 2: Temporary.
|
|
|
|
359
|
|
01:06:16.400 --> 01:06:33.430
|
|
A1CE Lecture 2: or short-term identity. So, any time that EC2 want to access S3, it has to authenticate with AWS API every time, right? Because it is short-term identity.
|
|
|
|
360
|
|
01:06:33.620 --> 01:06:38.259
|
|
A1CE Lecture 2: And it's only per request, right? So you…
|
|
|
|
361
|
|
01:06:39.250 --> 01:06:43.870
|
|
A1CE Lecture 2: what we gonna get from this? Because we can chain policy.
|
|
|
|
362
|
|
01:06:43.990 --> 01:06:54.630
|
|
A1CE Lecture 2: to this IAM role anytime that you want. This time, EC2 may be able to access S3, but the next day, you will say that, oh, is it this easy to…
|
|
|
|
363
|
|
01:06:54.710 --> 01:07:12.769
|
|
A1CE Lecture 2: don't need to exit S3. We can change the policy, and even EC2 is using the same role, but when we change policy, EC2 can… may not be able to exit S3 in the next day or in the next month, because
|
|
|
|
364
|
|
01:07:12.770 --> 01:07:17.840
|
|
A1CE Lecture 2: policy is chained, right? So… This is why, short-term.
|
|
|
|
365
|
|
01:07:18.010 --> 01:07:34.299
|
|
A1CE Lecture 2: identity is more secure, right? Because when you authenticate, you authenticate for this time, right? Next time, you have to authenticate again, and make sure that, if we still have access or not, it's validated.
|
|
|
|
366
|
|
01:07:34.490 --> 01:07:42.750
|
|
A1CE Lecture 2: every time that we send the request to AWS API, right? So it's more secure, because you validate the
|
|
|
|
367
|
|
01:07:43.000 --> 01:07:48.799
|
|
A1CE Lecture 2: Authentication and authorization anytime that you make a request, right?
|
|
|
|
368
|
|
01:07:50.080 --> 01:07:57.679
|
|
A1CE Lecture 2: Okay, and… I think we cover most of…
|
|
|
|
369
|
|
01:07:58.080 --> 01:08:06.030
|
|
A1CE Lecture 2: the important part of identity, right? So… Just…
|
|
|
|
370
|
|
01:08:06.490 --> 01:08:09.399
|
|
A1CE Lecture 2: recap a little bit. I am user.
|
|
|
|
371
|
|
01:08:11.090 --> 01:08:15.040
|
|
A1CE Lecture 2: is long-term, right? This is long-term.
|
|
|
|
372
|
|
01:08:17.790 --> 01:08:25.850
|
|
A1CE Lecture 2: identity. So, it mapped with Long-term kidney chill, right?
|
|
|
|
373
|
|
01:08:26.050 --> 01:08:31.129
|
|
A1CE Lecture 2: So, IAM user is long-term identity. There are two types
|
|
|
|
374
|
|
01:08:32.220 --> 01:08:37.240
|
|
A1CE Lecture 2: Of long-term credential that you can create.
|
|
|
|
375
|
|
01:08:38.000 --> 01:08:45.960
|
|
A1CE Lecture 2: with… I am user, right? Two types of long-term credential. One is password.
|
|
|
|
376
|
|
01:08:46.779 --> 01:08:52.879
|
|
A1CE Lecture 2: Right? And second one is… programmatic access.
|
|
|
|
377
|
|
01:08:56.920 --> 01:08:57.600
|
|
A1CE Lecture 2: Alright.
|
|
|
|
378
|
|
01:08:58.439 --> 01:09:03.450
|
|
A1CE Lecture 2: Both password and programmatic access are long-term, so…
|
|
|
|
379
|
|
01:09:03.870 --> 01:09:07.620
|
|
A1CE Lecture 2: We have to make sure that Neat.
|
|
|
|
380
|
|
01:09:08.660 --> 01:09:11.410
|
|
A1CE Lecture 2: 2… Ensure.
|
|
|
|
381
|
|
01:09:12.569 --> 01:09:19.319
|
|
A1CE Lecture 2: Dad… it… not… compromise.
|
|
|
|
382
|
|
01:09:20.080 --> 01:09:22.410
|
|
A1CE Lecture 2: Right? Because it is long-term.
|
|
|
|
383
|
|
01:09:22.580 --> 01:09:32.769
|
|
A1CE Lecture 2: It will be… able to… you will be able to use this long-term credential as long as it's active.
|
|
|
|
384
|
|
01:09:33.260 --> 01:09:43.620
|
|
A1CE Lecture 2: in your environment, right? So, this is quite important. So that's why I think, you may… know about…
|
|
|
|
385
|
|
01:09:44.140 --> 01:09:50.030
|
|
A1CE Lecture 2: How we can ensure that the long-term credential is not compromised.
|
|
|
|
386
|
|
01:09:51.229 --> 01:09:57.800
|
|
A1CE Lecture 2: very well known, or the approach that we use to is
|
|
|
|
387
|
|
01:09:58.100 --> 01:10:02.000
|
|
A1CE Lecture 2: Changing the password every specific period of time.
|
|
|
|
388
|
|
01:10:02.260 --> 01:10:09.240
|
|
A1CE Lecture 2: 3 months, 6 months, or shared password every 1 year, at least you have to load it.
|
|
|
|
389
|
|
01:10:09.370 --> 01:10:14.649
|
|
A1CE Lecture 2: the password, right? Because we want to ensure that if it compromised.
|
|
|
|
390
|
|
01:10:15.000 --> 01:10:19.449
|
|
A1CE Lecture 2: It will not have really significant,
|
|
|
|
391
|
|
01:10:20.250 --> 01:10:32.490
|
|
A1CE Lecture 2: affect to… or create the potential problem to our environment. So, make sure that we rotate the credential every specific period of time, right?
|
|
|
|
392
|
|
01:10:32.650 --> 01:10:44.449
|
|
A1CE Lecture 2: But… Okay, so… just… We will go back to this, but,
|
|
|
|
393
|
|
01:10:45.730 --> 01:10:53.670
|
|
A1CE Lecture 2: So, okay, we already talked about authentication and authorization. Is… the AWS service, right?
|
|
|
|
394
|
|
01:10:54.080 --> 01:10:57.700
|
|
A1CE Lecture 2: So, we talk about IAM user, right?
|
|
|
|
395
|
|
01:10:59.080 --> 01:11:02.759
|
|
A1CE Lecture 2: And… Okay, this is the…
|
|
|
|
396
|
|
01:11:03.080 --> 01:11:15.810
|
|
A1CE Lecture 2: credential for IAM user. So, there are two types of long-term credential, username and password. This is the first one. And programmatic access is,
|
|
|
|
397
|
|
01:11:16.200 --> 01:11:18.979
|
|
A1CE Lecture 2: I'm not sure that we have the example.
|
|
|
|
398
|
|
01:11:19.520 --> 01:11:20.470
|
|
A1CE Lecture 2: No.
|
|
|
|
399
|
|
01:11:20.850 --> 01:11:33.560
|
|
A1CE Lecture 2: Okay, so… For programmatic access, it's called the key pair, the pair of AWS, access key, And…
|
|
|
|
400
|
|
01:11:34.330 --> 01:11:36.079
|
|
A1CE Lecture 2: Secret access key.
|
|
|
|
401
|
|
01:11:36.190 --> 01:11:36.880
|
|
A1CE Lecture 2: Right.
|
|
|
|
402
|
|
01:11:40.120 --> 01:11:55.979
|
|
A1CE Lecture 2: AWS XT and AWS CKXT, right? Access key is just like key ID, right? And the key, the private key, is CKX8 key, right? Key content, right?
|
|
|
|
403
|
|
01:11:59.220 --> 01:12:16.269
|
|
A1CE Lecture 2: I'm… I have experience to handle both of… I create IAM user, and one IAM user, you can assign both type of credential for one user, right? One IAM user can have
|
|
|
|
404
|
|
01:12:16.420 --> 01:12:20.899
|
|
A1CE Lecture 2: 1AM, I am user 1, you can have password.
|
|
|
|
405
|
|
01:12:21.070 --> 01:12:26.239
|
|
A1CE Lecture 2: Right? And you also can have programmatic access.
|
|
|
|
406
|
|
01:12:27.340 --> 01:12:28.100
|
|
A1CE Lecture 2: Right?
|
|
|
|
407
|
|
01:12:28.680 --> 01:12:35.690
|
|
A1CE Lecture 2: you can use both, right? Because it's credential that you can use. And also, It also support.
|
|
|
|
408
|
|
01:12:36.520 --> 01:12:56.149
|
|
A1CE Lecture 2: multi-factor authentication, right? You can… by default, it's optional, you don't have… by default, it's disabled, but if you want more secure, level of access, right, you can enable multi-factor authentication for
|
|
|
|
409
|
|
01:12:56.160 --> 01:13:00.329
|
|
A1CE Lecture 2: each IAM user, or…
|
|
|
|
410
|
|
01:13:00.390 --> 01:13:09.440
|
|
A1CE Lecture 2: I am role, if you want. I am role, I'm not sure, but I am user, I'm sure that each I am user, you can assign
|
|
|
|
411
|
|
01:13:09.600 --> 01:13:23.249
|
|
A1CE Lecture 2: all this, right? IAM user can have a password, right? IAM user can have programmatic access, and IAM user can set up or enable multi-factor authentication, right?
|
|
|
|
412
|
|
01:13:23.250 --> 01:13:38.330
|
|
A1CE Lecture 2: So, it's just the second credential that you have to provide. At least, you have to provide credential either password or programmatic access. But if you have MFA, this means if you only… if you have
|
|
|
|
413
|
|
01:13:38.330 --> 01:13:47.840
|
|
A1CE Lecture 2: correct password, or if you have correct programmatic access, you still have to provide a code for multi-factor authenticator, right?
|
|
|
|
414
|
|
01:13:47.890 --> 01:13:52.720
|
|
A1CE Lecture 2: In order to successfully authenticate and authorize, right?
|
|
|
|
415
|
|
01:13:53.010 --> 01:14:03.310
|
|
A1CE Lecture 2: But… the credential that I found that easy to compromise based on my experience.
|
|
|
|
416
|
|
01:14:05.110 --> 01:14:11.249
|
|
A1CE Lecture 2: This one, programmatic access, right? Because, some people will store…
|
|
|
|
417
|
|
01:14:11.790 --> 01:14:31.470
|
|
A1CE Lecture 2: But I think right now, it's gonna be less, because people have enough experience, because in the past, I think past 5… 5 years ago, programmatic access is just, like, some people just upload the code into public people, such as GitHub.
|
|
|
|
418
|
|
01:14:31.830 --> 01:14:38.449
|
|
A1CE Lecture 2: And it contains XH key and sec key inside the code.
|
|
|
|
419
|
|
01:14:38.580 --> 01:14:43.499
|
|
A1CE Lecture 2: And the hacker will have a bot to crawl, right? And…
|
|
|
|
420
|
|
01:14:43.830 --> 01:14:46.899
|
|
A1CE Lecture 2: It's really easy to compromise, and…
|
|
|
|
421
|
|
01:14:47.040 --> 01:14:49.489
|
|
A1CE Lecture 2: From my experience editing, every year.
|
|
|
|
422
|
|
01:14:49.860 --> 01:14:59.370
|
|
A1CE Lecture 2: If I provide programmatic access, for about 20 or 40 users, At least… One.
|
|
|
|
423
|
|
01:15:00.230 --> 01:15:04.709
|
|
A1CE Lecture 2: One cadence here will be compromised. It's programmatic access.
|
|
|
|
424
|
|
01:15:04.910 --> 01:15:05.900
|
|
A1CE Lecture 2: Password.
|
|
|
|
425
|
|
01:15:06.300 --> 01:15:19.540
|
|
A1CE Lecture 2: I never have experience from the password compromise at all, right? For 5 years, no password compromise, right? But programmatic access is just, like, every year.
|
|
|
|
426
|
|
01:15:19.710 --> 01:15:28.190
|
|
A1CE Lecture 2: Until now. Even, I say it every time that make sure that you… Protect this programmatic access.
|
|
|
|
427
|
|
01:15:30.510 --> 01:15:35.390
|
|
A1CE Lecture 2: And do it. Important, and I just say that please do not
|
|
|
|
428
|
|
01:15:35.600 --> 01:15:46.360
|
|
A1CE Lecture 2: leak, or make any risks to leak this credential, because it's important. I just only can reduce the number of compromise.
|
|
|
|
429
|
|
01:15:46.620 --> 01:15:49.630
|
|
A1CE Lecture 2: That happens each year. But… never.
|
|
|
|
430
|
|
01:15:49.770 --> 01:15:58.859
|
|
A1CE Lecture 2: never, it's… it never disappeared. It just, like, happened every time. So,
|
|
|
|
431
|
|
01:15:59.250 --> 01:16:14.920
|
|
A1CE Lecture 2: when people, want programmatic access for me, right, I just have to just, like, I have to talk, right? What you want to do, what you want to use, and I have to write a policy that is quite specific.
|
|
|
|
432
|
|
01:16:15.100 --> 01:16:22.950
|
|
A1CE Lecture 2: I want to make sure that, policy for programmatic access is very… or…
|
|
|
|
433
|
|
01:16:23.070 --> 01:16:28.040
|
|
A1CE Lecture 2: policy for IAM user that has programmedity access.
|
|
|
|
434
|
|
01:16:28.320 --> 01:16:30.189
|
|
A1CE Lecture 2: Right? So…
|
|
|
|
435
|
|
01:16:30.860 --> 01:16:49.520
|
|
A1CE Lecture 2: for my solution, right? This is my… my experience, right? It may not apply to some use case, but this is what I do, when I work with, even. For example, I have… I am user for Group 1.
|
|
|
|
436
|
|
01:16:49.810 --> 01:16:57.179
|
|
A1CE Lecture 2: Right? I… if Group 1 is maybe, dev, right? Dev team, right?
|
|
|
|
437
|
|
01:16:58.040 --> 01:17:12.249
|
|
A1CE Lecture 2: If this is IAM user for human, I will say that, okay, this is IAM user, and this is, policy for IAM user, policy one, but if dev team need programmatic access.
|
|
|
|
438
|
|
01:17:13.400 --> 01:17:15.259
|
|
A1CE Lecture 2: I will create.
|
|
|
|
439
|
|
01:17:16.000 --> 01:17:18.770
|
|
A1CE Lecture 2: Another… IAM user.
|
|
|
|
440
|
|
01:17:20.970 --> 01:17:21.970
|
|
A1CE Lecture 2: Excuse me?
|
|
|
|
441
|
|
01:17:22.310 --> 01:17:23.780
|
|
A1CE Lecture 2: I separate.
|
|
|
|
442
|
|
01:17:24.660 --> 01:17:26.810
|
|
A1CE Lecture 2: identity for…
|
|
|
|
443
|
|
01:17:27.400 --> 01:17:40.320
|
|
A1CE Lecture 2: password, and I have separate identity, even if it's for the same team, right? The same team, but I will create policy 2, right, for
|
|
|
|
444
|
|
01:17:40.570 --> 01:17:51.990
|
|
A1CE Lecture 2: programmatic access only, right? Because… One thing is because I… this policy is… More strict, right?
|
|
|
|
445
|
|
01:17:52.120 --> 01:18:02.570
|
|
A1CE Lecture 2: Because, why? Why I come up with this solution at the end? Right, because I cannot…
|
|
|
|
446
|
|
01:18:02.810 --> 01:18:11.309
|
|
A1CE Lecture 2: Ensure that… compromise of programmatic access will not happen, right? It will happen.
|
|
|
|
447
|
|
01:18:11.600 --> 01:18:19.419
|
|
A1CE Lecture 2: So, I have to change my mind after 2 years, right? First 2 years, I try to make sure that I…
|
|
|
|
448
|
|
01:18:20.050 --> 01:18:27.310
|
|
A1CE Lecture 2: can decrease the compromise for programmatic access to zero. I tried that for 2 years, and I just…
|
|
|
|
449
|
|
01:18:28.130 --> 01:18:38.199
|
|
A1CE Lecture 2: reached the conclusion that I cannot do that, right? If I cannot do that, but I have still need to provide the program with the access, I separate.
|
|
|
|
450
|
|
01:18:38.330 --> 01:18:50.979
|
|
A1CE Lecture 2: Right? One is for human, one is for programmatic access. I also make the policy more strict, and sometimes it's just like, what I use is log
|
|
|
|
451
|
|
01:18:51.120 --> 01:18:53.320
|
|
A1CE Lecture 2: 2… 1 region.
|
|
|
|
452
|
|
01:18:54.390 --> 01:18:59.450
|
|
A1CE Lecture 2: Right? It's just that if you can create VM, if…
|
|
|
|
453
|
|
01:18:59.590 --> 01:19:13.060
|
|
A1CE Lecture 2: If you are human, and you use this policy one, you can create in any region, it's okay, right? But if this is for programmatic access, I would say that you can use
|
|
|
|
454
|
|
01:19:13.200 --> 01:19:20.629
|
|
A1CE Lecture 2: only in… Thailand region, or you can use in Singapore region, right? Because if it's compromised.
|
|
|
|
455
|
|
01:19:21.830 --> 01:19:23.710
|
|
A1CE Lecture 2: Hacker will use this
|
|
|
|
456
|
|
01:19:23.890 --> 01:19:39.310
|
|
A1CE Lecture 2: programmatic access to create resource only within one region, and it's better, right? It's just, like, control the blast area, right? If it's compromised, user can do with one region, and it
|
|
|
|
457
|
|
01:19:39.330 --> 01:19:46.680
|
|
A1CE Lecture 2: easy to, to detect and contain the problem, right? So that is what I do, right? But…
|
|
|
|
458
|
|
01:19:47.810 --> 01:19:59.289
|
|
A1CE Lecture 2: you have one more identity to work with anytime, right? If you have 5 teams, it means you maintain 10 identities for all the team, but for me, it's…
|
|
|
|
459
|
|
01:19:59.480 --> 01:20:06.289
|
|
A1CE Lecture 2: the way I… I think I'm comfortable, and I think it's the better one. And also, when…
|
|
|
|
460
|
|
01:20:06.530 --> 01:20:10.339
|
|
A1CE Lecture 2: I also can't know, because if this
|
|
|
|
461
|
|
01:20:10.670 --> 01:20:14.590
|
|
A1CE Lecture 2: Credential for programmatic access is leaked.
|
|
|
|
462
|
|
01:20:14.900 --> 01:20:21.760
|
|
A1CE Lecture 2: I can check with the user activity that, okay, just only look for
|
|
|
|
463
|
|
01:20:22.960 --> 01:20:35.170
|
|
A1CE Lecture 2: this username, right? What action from this username do in AWS environment? So, I can check, because if I have one username, and
|
|
|
|
464
|
|
01:20:35.450 --> 01:20:41.500
|
|
A1CE Lecture 2: I have programmatic access, password, and multi-factor authentication to one user.
|
|
|
|
465
|
|
01:20:41.800 --> 01:20:48.300
|
|
A1CE Lecture 2: I will not know whether this requires using programmatic access, or this
|
|
|
|
466
|
|
01:20:48.600 --> 01:20:53.530
|
|
A1CE Lecture 2: access using password. So, separate into two identity.
|
|
|
|
467
|
|
01:20:53.710 --> 01:20:57.369
|
|
A1CE Lecture 2: Easy to troubleshoot the problem, right?
|
|
|
|
468
|
|
01:20:57.690 --> 01:21:04.569
|
|
A1CE Lecture 2: So that's, that's why is the reason I'm using this, configuration, right?
|
|
|
|
469
|
|
01:21:05.770 --> 01:21:10.270
|
|
A1CE Lecture 2: Okay, so this is, IAM user.
|
|
|
|
470
|
|
01:21:10.440 --> 01:21:13.999
|
|
A1CE Lecture 2: So, for IAM role, right?
|
|
|
|
471
|
|
01:21:14.440 --> 01:21:26.090
|
|
A1CE Lecture 2: For IAM role, you don't have credential, right? But it will generate from, generate, token?
|
|
|
|
472
|
|
01:21:26.200 --> 01:21:28.400
|
|
A1CE Lecture 2: Right? Temporary token?
|
|
|
|
473
|
|
01:21:29.590 --> 01:21:30.430
|
|
A1CE Lecture 2: Right?
|
|
|
|
474
|
|
01:21:30.660 --> 01:21:43.750
|
|
A1CE Lecture 2: From the backend service in AWS called AWS STS, right? Security… token session.
|
|
|
|
475
|
|
01:21:45.190 --> 01:21:47.149
|
|
A1CE Lecture 2: I'm not sure, I'll have to check, but…
|
|
|
|
476
|
|
01:21:47.270 --> 01:22:01.389
|
|
A1CE Lecture 2: there's the service in AWS that, if you create IAM role, it will be in the IAM, right? So if the AWS service or any identity try to assume role,
|
|
|
|
477
|
|
01:22:01.460 --> 01:22:11.460
|
|
A1CE Lecture 2: it will check that, okay, is this role is allowed to be used, right? And if the role is allowed to be used.
|
|
|
|
478
|
|
01:22:11.610 --> 01:22:28.209
|
|
A1CE Lecture 2: AWS STS will create temporary token back to the client, and the client can use that token to access the AWS resource, right? And it's temporary, it means it have
|
|
|
|
479
|
|
01:22:29.370 --> 01:22:33.810
|
|
A1CE Lecture 2: You can set time limit, right?
|
|
|
|
480
|
|
01:22:34.850 --> 01:22:36.169
|
|
A1CE Lecture 2: For the token.
|
|
|
|
481
|
|
01:22:39.590 --> 01:22:41.710
|
|
A1CE Lecture 2: Right? It can be the… the…
|
|
|
|
482
|
|
01:22:42.220 --> 01:22:47.559
|
|
A1CE Lecture 2: The token can be used within limited period of time.
|
|
|
|
483
|
|
01:22:47.960 --> 01:22:56.920
|
|
A1CE Lecture 2: Currently, the default, if you not specify, if you create an role, and you not specify that
|
|
|
|
484
|
|
01:22:57.140 --> 01:23:00.729
|
|
A1CE Lecture 2: How long that this role can be used.
|
|
|
|
485
|
|
01:23:00.860 --> 01:23:05.280
|
|
A1CE Lecture 2: Default… time limit.
|
|
|
|
486
|
|
01:23:06.790 --> 01:23:08.570
|
|
A1CE Lecture 2: And I have to stray it.
|
|
|
|
487
|
|
01:23:08.920 --> 01:23:16.380
|
|
A1CE Lecture 2: That is the default time limit for now, is… 12 hours.
|
|
|
|
488
|
|
01:23:16.630 --> 01:23:23.349
|
|
A1CE Lecture 2: by default, right? So, when you use IAM role, you can specify I think…
|
|
|
|
489
|
|
01:23:23.720 --> 01:23:28.480
|
|
A1CE Lecture 2: The shortest, time limit is 1 minute.
|
|
|
|
490
|
|
01:23:28.880 --> 01:23:37.949
|
|
A1CE Lecture 2: Right? One minute is the shortest, if I… if I remember correctly. But the default value is 12 hours, right? So…
|
|
|
|
491
|
|
01:23:38.290 --> 01:23:44.379
|
|
A1CE Lecture 2: even you not config anything, and you're using IAM role, you can access for 12 hours.
|
|
|
|
492
|
|
01:23:45.630 --> 01:23:51.829
|
|
A1CE Lecture 2: But, 2 years ago, The default value is 8 hours.
|
|
|
|
493
|
|
01:23:52.380 --> 01:24:01.769
|
|
A1CE Lecture 2: 3 years ago, the default value is 4 out. That's… that's why I said that it's the default value for now, because
|
|
|
|
494
|
|
01:24:01.870 --> 01:24:18.659
|
|
A1CE Lecture 2: In previous 3 years, it changed 2 times, right? So, make sure that, you check with the AWS document, right? What is the default value? So, for me, as the system and network engineer.
|
|
|
|
495
|
|
01:24:18.700 --> 01:24:26.900
|
|
A1CE Lecture 2: Normally, I don't like default value, right? If I want to use for temporary access, I want to specify.
|
|
|
|
496
|
|
01:24:27.220 --> 01:24:30.879
|
|
A1CE Lecture 2: how long it gonna take, right? But…
|
|
|
|
497
|
|
01:24:31.410 --> 01:24:46.129
|
|
A1CE Lecture 2: I think this can be said by, Can only… Set using… command line interface, or SDK.
|
|
|
|
498
|
|
01:24:46.360 --> 01:24:56.360
|
|
A1CE Lecture 2: It means you cannot config the TAM if you use management console, but
|
|
|
|
499
|
|
01:24:56.490 --> 01:25:13.739
|
|
A1CE Lecture 2: This is also another thing that it may change, right? But normally, when I try to… to set the time limit for IAM role, normally I create IAM role by using command line interface, or using software development kit, but
|
|
|
|
500
|
|
01:25:14.190 --> 01:25:21.160
|
|
A1CE Lecture 2: For myself, yes, I'm not a software engineer, so normally, I will use command line interface.
|
|
|
|
501
|
|
01:25:21.570 --> 01:25:30.849
|
|
A1CE Lecture 2: the most, right? SDK, I'm using a little, when I'm teaching about, software development in
|
|
|
|
502
|
|
01:25:31.570 --> 01:25:43.199
|
|
A1CE Lecture 2: In some course, but normally, okay, I will use CLI, but I never use Management Console if I want to set default time limit.
|
|
|
|
503
|
|
01:25:43.680 --> 01:25:59.849
|
|
A1CE Lecture 2: But I think Management Console may be updates, right? Because I think this year, from my experience, if you use AWS for a long time, this year, you will notice that a lot of things is changing and updated in management console.
|
|
|
|
504
|
|
01:26:01.120 --> 01:26:13.430
|
|
A1CE Lecture 2: Okay, so this is IAM role, this is for temporary access, and you don't have to specify any type of, credential, right? Because,
|
|
|
|
505
|
|
01:26:13.900 --> 01:26:19.040
|
|
A1CE Lecture 2: only IAM user, that you can specify credential, right?
|
|
|
|
506
|
|
01:26:19.310 --> 01:26:33.540
|
|
A1CE Lecture 2: For IAM role, it's temporary, and it's using a short-term token that's generated from AWS STS, right? You don't have to config, it's just the back-end thing that AWS do that for you.
|
|
|
|
507
|
|
01:26:35.440 --> 01:26:37.230
|
|
A1CE Lecture 2: Okay,
|
|
|
|
508
|
|
01:26:40.890 --> 01:26:46.589
|
|
A1CE Lecture 2: Let me check what I have still done cover.
|
|
|
|
509
|
|
01:26:47.220 --> 01:27:02.529
|
|
A1CE Lecture 2: For identity, I think we covered everything. Oh, I am user, I am role. And I am user group. This… normally in the past, it's called I am group, but I am user group.
|
|
|
|
510
|
|
01:27:03.040 --> 01:27:06.130
|
|
A1CE Lecture 2: is for… diminished.
|
|
|
|
511
|
|
01:27:07.280 --> 01:27:09.390
|
|
A1CE Lecture 2: Okay, I… I ride.
|
|
|
|
512
|
|
01:27:10.650 --> 01:27:14.600
|
|
A1CE Lecture 2: for IAM user group.
|
|
|
|
513
|
|
01:27:15.870 --> 01:27:18.390
|
|
A1CE Lecture 2: is for managed.
|
|
|
|
514
|
|
01:27:20.440 --> 01:27:30.410
|
|
A1CE Lecture 2: Policy… In… in environment.
|
|
|
|
515
|
|
01:27:34.030 --> 01:27:43.160
|
|
A1CE Lecture 2: that… We have… Lars… Number… of…
|
|
|
|
516
|
|
01:27:43.400 --> 01:27:51.309
|
|
A1CE Lecture 2: user, right? So, based on the name, I think you may know, right? We can create I am…
|
|
|
|
517
|
|
01:27:51.820 --> 01:27:54.160
|
|
A1CE Lecture 2: user… group.
|
|
|
|
518
|
|
01:27:55.180 --> 01:27:59.800
|
|
A1CE Lecture 2: depth, Right? And we can create.
|
|
|
|
519
|
|
01:28:00.280 --> 01:28:06.150
|
|
A1CE Lecture 2: I am… User… group… Production.
|
|
|
|
520
|
|
01:28:06.590 --> 01:28:08.649
|
|
A1CE Lecture 2: And you can attach.
|
|
|
|
521
|
|
01:28:10.140 --> 01:28:20.400
|
|
A1CE Lecture 2: User A, or user B, and user C, and user D. And when you attach policy, right, because if you are dead.
|
|
|
|
522
|
|
01:28:20.640 --> 01:28:23.819
|
|
A1CE Lecture 2: team, and if IUR production team.
|
|
|
|
523
|
|
01:28:23.920 --> 01:28:26.380
|
|
A1CE Lecture 2: You may need to…
|
|
|
|
524
|
|
01:28:26.580 --> 01:28:40.359
|
|
A1CE Lecture 2: a different set of policy, right? So this is policy 1, this is policy 3, right? And for depth, you may need Policy 1, and you may need Policy 2.
|
|
|
|
525
|
|
01:28:40.480 --> 01:28:52.359
|
|
A1CE Lecture 2: Right? So, you don't have to connect policy directly to each identity, right? Because if you are in the same team, right, you just
|
|
|
|
526
|
|
01:28:52.470 --> 01:29:05.220
|
|
A1CE Lecture 2: become member of IAM user group, the same IAM user group. So, if you're a dev team, you become a member of IAM user group DEP,
|
|
|
|
527
|
|
01:29:05.540 --> 01:29:17.940
|
|
A1CE Lecture 2: And you attach the policy for the dev team directly to the user group, right? And user that the member of that user group will inherit.
|
|
|
|
528
|
|
01:29:18.570 --> 01:29:33.070
|
|
A1CE Lecture 2: Policy 1 and Policy 2 from the user group, right? To make sure that if one day you have to update the policy, right? So, this dev team may use… need policy 4.
|
|
|
|
529
|
|
01:29:33.670 --> 01:29:38.639
|
|
A1CE Lecture 2: it will… Inherit automatically from
|
|
|
|
530
|
|
01:29:39.250 --> 01:29:54.790
|
|
A1CE Lecture 2: IAM user group to all the user that is the member of the same user group. So, we make sure that the policy for each user will be consistent, even you update, right?
|
|
|
|
531
|
|
01:29:55.520 --> 01:30:15.469
|
|
A1CE Lecture 2: So, this is the… the main use case of IAM user group, is to group users that have the same type of policy, and we can manage the consistency implementation of policy for each specific group, right? So, we use IAM user group.
|
|
|
|
532
|
|
01:30:17.480 --> 01:30:23.530
|
|
A1CE Lecture 2: Okay, so we addressed I am user, I am group, and I am role.
|
|
|
|
533
|
|
01:30:23.660 --> 01:30:30.340
|
|
A1CE Lecture 2: Right? The last thing that we need to talk about is policy, right?
|
|
|
|
534
|
|
01:30:31.160 --> 01:30:33.859
|
|
A1CE Lecture 2: For policy,
|
|
|
|
535
|
|
01:30:36.360 --> 01:30:47.910
|
|
A1CE Lecture 2: One important thing that I need everyone to remember, this is what you have to use all the time, right?
|
|
|
|
536
|
|
01:30:48.640 --> 01:30:49.780
|
|
A1CE Lecture 2: What it is.
|
|
|
|
537
|
|
01:30:50.990 --> 01:30:52.920
|
|
A1CE Lecture 2: for IAM policy.
|
|
|
|
538
|
|
01:30:54.470 --> 01:30:58.820
|
|
A1CE Lecture 2: So, one thing, each… Identity?
|
|
|
|
539
|
|
01:31:01.350 --> 01:31:04.560
|
|
A1CE Lecture 2: must… Attached.
|
|
|
|
540
|
|
01:31:05.870 --> 01:31:09.460
|
|
A1CE Lecture 2: with… At least.
|
|
|
|
541
|
|
01:31:11.360 --> 01:31:14.630
|
|
A1CE Lecture 2: One, I am policy.
|
|
|
|
542
|
|
01:31:15.390 --> 01:31:22.520
|
|
A1CE Lecture 2: But… It can.
|
|
|
|
543
|
|
01:31:23.600 --> 01:31:24.580
|
|
A1CE Lecture 2: Attached.
|
|
|
|
544
|
|
01:31:25.970 --> 01:31:34.160
|
|
A1CE Lecture 2: up to… I think if the number's still the same, it's up to… 15 policy.
|
|
|
|
545
|
|
01:31:34.400 --> 01:31:41.959
|
|
A1CE Lecture 2: for one IAM user. For example, if you are user A, right, user A can attach with
|
|
|
|
546
|
|
01:31:42.260 --> 01:31:46.620
|
|
A1CE Lecture 2: two policy. Policy 1 and Policy 2, right?
|
|
|
|
547
|
|
01:31:46.760 --> 01:31:47.720
|
|
A1CE Lecture 2: And…
|
|
|
|
548
|
|
01:31:50.460 --> 01:32:08.319
|
|
A1CE Lecture 2: when you evaluate policy for each identity, it will evaluate or attach policy at the same time, right? So it may be possible that this may be happened. Policy 1 allows
|
|
|
|
549
|
|
01:32:08.890 --> 01:32:17.600
|
|
A1CE Lecture 2: action… X, Right? And policy to… Deny.
|
|
|
|
550
|
|
01:32:17.810 --> 01:32:18.930
|
|
A1CE Lecture 2: Action.
|
|
|
|
551
|
|
01:32:19.400 --> 01:32:20.230
|
|
A1CE Lecture 2: X.
|
|
|
|
552
|
|
01:32:20.910 --> 01:32:36.339
|
|
A1CE Lecture 2: So, when this user… send requests, to perform action X, 2… AWS API, right?
|
|
|
|
553
|
|
01:32:36.460 --> 01:32:41.070
|
|
A1CE Lecture 2: Aws API will, if they pass authentication.
|
|
|
|
554
|
|
01:32:41.240 --> 01:32:48.210
|
|
A1CE Lecture 2: If this is… user A is correct user, and when they try to authorize.
|
|
|
|
555
|
|
01:32:48.360 --> 01:32:55.819
|
|
A1CE Lecture 2: it has to check Policy 1 and Policy 2, right? But it will check all policy at the same time.
|
|
|
|
556
|
|
01:32:56.130 --> 01:33:08.580
|
|
A1CE Lecture 2: And it will be followed by this diagram, right? It evaluates all applicable policy. It means it evaluated policy 1 and 2 at the same time.
|
|
|
|
557
|
|
01:33:09.140 --> 01:33:13.000
|
|
A1CE Lecture 2: But what will be evaluated first?
|
|
|
|
558
|
|
01:33:14.900 --> 01:33:18.529
|
|
A1CE Lecture 2: what is explicit deny? So, what…
|
|
|
|
559
|
|
01:33:18.590 --> 01:33:26.030
|
|
A1CE Lecture 2: the policy that say deny, right? If there are denied, specify.
|
|
|
|
560
|
|
01:33:26.090 --> 01:33:40.449
|
|
A1CE Lecture 2: clearly in the policy, if it's yes, it's denied, right? So, what happens if user A requests to perform action X with the specific resource, right?
|
|
|
|
561
|
|
01:33:40.680 --> 01:33:51.009
|
|
A1CE Lecture 2: for authorization, it will check both policy, right, which one is said explicit deny for action X. In this case.
|
|
|
|
562
|
|
01:33:51.710 --> 01:33:55.549
|
|
A1CE Lecture 2: Yeah, it will be filed at Policy 2,
|
|
|
|
563
|
|
01:33:56.450 --> 01:34:01.110
|
|
A1CE Lecture 2: specify that deny action X, so the outcome is
|
|
|
|
564
|
|
01:34:02.440 --> 01:34:15.020
|
|
A1CE Lecture 2: deny, right? Deny, win, right? So, what the AWS API will respond back is, It's not allowed, right?
|
|
|
|
565
|
|
01:34:15.260 --> 01:34:16.020
|
|
A1CE Lecture 2: Fail.
|
|
|
|
566
|
|
01:34:16.670 --> 01:34:22.289
|
|
A1CE Lecture 2: Right? Because you're not allowed to perform this action X, because policy 2,
|
|
|
|
567
|
|
01:34:22.460 --> 01:34:29.289
|
|
A1CE Lecture 2: specify that you cannot perform action A with this resource, right?
|
|
|
|
568
|
|
01:34:29.990 --> 01:34:44.249
|
|
A1CE Lecture 2: And… but if there are no explicit deny, so we check explicit allow, is provided in the policy or not. If yes, allow, right? But if no, is
|
|
|
|
569
|
|
01:34:44.880 --> 01:34:55.480
|
|
A1CE Lecture 2: implicit deny, right? So, if the policy do not specify that is explicit deny or Explicit allow.
|
|
|
|
570
|
|
01:34:55.970 --> 01:35:02.340
|
|
A1CE Lecture 2: You can assume that the action Will be denied, because…
|
|
|
|
571
|
|
01:35:02.890 --> 01:35:15.360
|
|
A1CE Lecture 2: If there are no explicit deny, no explicit allow, it will be implicit deny, right? So this is how IAM policy works, right?
|
|
|
|
572
|
|
01:35:16.650 --> 01:35:23.870
|
|
A1CE Lecture 2: So, another thing, if you have policy, right, policy will have
|
|
|
|
573
|
|
01:35:24.000 --> 01:35:28.050
|
|
A1CE Lecture 2: statement, right? The statement of each policy.
|
|
|
|
574
|
|
01:35:28.190 --> 01:35:36.139
|
|
A1CE Lecture 2: You have Stedman, and you will have effect, right? Effect is, allow.
|
|
|
|
575
|
|
01:35:36.500 --> 01:35:44.570
|
|
A1CE Lecture 2: or deny, right? And it will have action, so it will just have resource.
|
|
|
|
576
|
|
01:35:45.790 --> 01:35:52.670
|
|
A1CE Lecture 2: and action that is possible. For example, EC2?
|
|
|
|
577
|
|
01:35:53.020 --> 01:36:01.970
|
|
A1CE Lecture 2: And if action is star, it means that white card Whitehart, is…
|
|
|
|
578
|
|
01:36:02.590 --> 01:36:07.100
|
|
A1CE Lecture 2: You can do anything. You can do… Anything.
|
|
|
|
579
|
|
01:36:07.680 --> 01:36:08.959
|
|
A1CE Lecture 2: If it's by cut.
|
|
|
|
580
|
|
01:36:09.240 --> 01:36:13.439
|
|
A1CE Lecture 2: And this is action, right? So you can do any action.
|
|
|
|
581
|
|
01:36:14.140 --> 01:36:22.480
|
|
A1CE Lecture 2: with the EC2 or Virtual Machine Resource, and effect, action, and… resource.
|
|
|
|
582
|
|
01:36:23.570 --> 01:36:24.280
|
|
A1CE Lecture 2: Right.
|
|
|
|
583
|
|
01:36:24.400 --> 01:36:35.379
|
|
A1CE Lecture 2: And what is resource, right? If this is EC2, it's meanVM, it's… you may specify that resource is EC2,
|
|
|
|
584
|
|
01:36:35.510 --> 01:36:50.510
|
|
A1CE Lecture 2: A, right? Or, it can be star, it means white card, any easy tool in your AWS environment is possible, right? So, this is, in each statement in the policy, you have to specify ethic.
|
|
|
|
585
|
|
01:36:50.930 --> 01:36:51.980
|
|
A1CE Lecture 2: Action.
|
|
|
|
586
|
|
01:36:52.140 --> 01:37:04.270
|
|
A1CE Lecture 2: resource, right? And the… the fourth syntax is condition, right? But condition is only…
|
|
|
|
587
|
|
01:37:04.610 --> 01:37:09.920
|
|
A1CE Lecture 2: only thing that is optional. It means you can specify a condition.
|
|
|
|
588
|
|
01:37:10.050 --> 01:37:21.390
|
|
A1CE Lecture 2: or you don't have to specify any condition. It will decide based on effect, action, and resource, right? So this is policy statement.
|
|
|
|
589
|
|
01:37:23.110 --> 01:37:26.280
|
|
A1CE Lecture 2: Okay.
|
|
|
|
590
|
|
01:37:26.550 --> 01:37:35.450
|
|
A1CE Lecture 2: So, look at the example. For any policy, you have to specify effect.
|
|
|
|
591
|
|
01:37:35.600 --> 01:37:43.729
|
|
A1CE Lecture 2: action, and resource, right? If you don't have condition, it's okay, right? It still works, right?
|
|
|
|
592
|
|
01:37:43.920 --> 01:37:45.349
|
|
A1CE Lecture 2: 4 version?
|
|
|
|
593
|
|
01:37:45.520 --> 01:37:53.239
|
|
A1CE Lecture 2: it using the same number, right? Right now, this is the version that we use. 2020… 2012?
|
|
|
|
594
|
|
01:37:53.880 --> 01:38:03.149
|
|
A1CE Lecture 2: 10, 17, right? You will not change. It will not change at this time, right? You have to specify effect, action, and resource.
|
|
|
|
595
|
|
01:38:03.880 --> 01:38:09.049
|
|
A1CE Lecture 2: I will look for condition, no condition.
|
|
|
|
596
|
|
01:38:10.330 --> 01:38:12.789
|
|
A1CE Lecture 2: Which one is… okay.
|
|
|
|
597
|
|
01:38:13.650 --> 01:38:20.640
|
|
A1CE Lecture 2: So, in some policy, it will have… condition.
|
|
|
|
598
|
|
01:38:21.420 --> 01:38:32.500
|
|
A1CE Lecture 2: Right? So, if the policy statement has condition, it means it will evaluate condition first, right?
|
|
|
|
599
|
|
01:38:32.810 --> 01:38:40.470
|
|
A1CE Lecture 2: it still not check effect, action, or resource yet. If, it will not check
|
|
|
|
600
|
|
01:38:40.630 --> 01:38:51.380
|
|
A1CE Lecture 2: effect, action, or resource yet, it will check condition first, right? If condition return true, Then, we check FA.
|
|
|
|
601
|
|
01:38:51.630 --> 01:38:53.579
|
|
A1CE Lecture 2: Action, and resource.
|
|
|
|
602
|
|
01:38:53.740 --> 01:38:54.470
|
|
A1CE Lecture 2: Right.
|
|
|
|
603
|
|
01:38:54.650 --> 01:38:59.480
|
|
A1CE Lecture 2: But if… The condition return balls.
|
|
|
|
604
|
|
01:39:01.220 --> 01:39:07.209
|
|
A1CE Lecture 2: the outcome is denied, right? So, if the condition is true.
|
|
|
|
605
|
|
01:39:07.470 --> 01:39:11.300
|
|
A1CE Lecture 2: We check what the policy specifies.
|
|
|
|
606
|
|
01:39:11.470 --> 01:39:15.410
|
|
A1CE Lecture 2: But if the condition returns false.
|
|
|
|
607
|
|
01:39:16.370 --> 01:39:22.110
|
|
A1CE Lecture 2: It will say that, okay, this action is denied without shaking effect.
|
|
|
|
608
|
|
01:39:22.240 --> 01:39:26.140
|
|
A1CE Lecture 2: action or resource, right? Because condition is fall.
|
|
|
|
609
|
|
01:39:28.430 --> 01:39:34.079
|
|
A1CE Lecture 2: Okay, and this is the example of IAM policy,
|
|
|
|
610
|
|
01:39:36.310 --> 01:39:44.170
|
|
A1CE Lecture 2: Okay, I think one of the last things that is important
|
|
|
|
611
|
|
01:39:45.360 --> 01:39:57.910
|
|
A1CE Lecture 2: Last thing that is important for this… But… I will give you as… as,
|
|
|
|
612
|
|
01:39:58.450 --> 01:40:00.860
|
|
A1CE Lecture 2: I, I will ask you,
|
|
|
|
613
|
|
01:40:01.220 --> 01:40:10.849
|
|
A1CE Lecture 2: the question in the Google Form, again. For this week, last week, we have, assignment in Google Form, right?
|
|
|
|
614
|
|
01:40:11.250 --> 01:40:17.289
|
|
A1CE Lecture 2: And I think for this week, I also will ask you to,
|
|
|
|
615
|
|
01:40:18.410 --> 01:40:21.750
|
|
A1CE Lecture 2: Sorry. I asked you to answer the Google Form.
|
|
|
|
616
|
|
01:40:21.860 --> 01:40:23.900
|
|
A1CE Lecture 2: And sorry, I have to shake.
|
|
|
|
617
|
|
01:40:24.260 --> 01:40:27.200
|
|
A1CE Lecture 2: Will there be the total weather induced?
|
|
|
|
618
|
|
01:40:29.960 --> 01:40:41.859
|
|
A1CE Lecture 2: IS admin form… Okay, okay, Matt, thank you. I will provide that, I will add…
|
|
|
|
619
|
|
01:40:42.710 --> 01:40:47.519
|
|
A1CE Lecture 2: That information that you asked, in the canvas, right?
|
|
|
|
620
|
|
01:40:47.940 --> 01:40:51.410
|
|
A1CE Lecture 2: But for last week, I'm not…
|
|
|
|
621
|
|
01:40:51.640 --> 01:40:54.849
|
|
A1CE Lecture 2: It, it just warns you…
|
|
|
|
622
|
|
01:40:55.090 --> 01:41:01.629
|
|
A1CE Lecture 2: just get the idea, because last week, it's just, introduction. So any…
|
|
|
|
623
|
|
01:41:01.700 --> 01:41:15.390
|
|
A1CE Lecture 2: I, I'm not looking for specific detail from your answer, I just, like, check what, what, what you understand from, the lecture that we discussed. But…
|
|
|
|
624
|
|
01:41:15.420 --> 01:41:18.839
|
|
A1CE Lecture 2: Okay, but for starting from this week.
|
|
|
|
625
|
|
01:41:18.870 --> 01:41:29.519
|
|
A1CE Lecture 2: yes, I… I will have, the Kite River, right? But I think, for me, I'm not about, I will have kite everywhere, but it's not… not for
|
|
|
|
626
|
|
01:41:29.520 --> 01:41:40.270
|
|
A1CE Lecture 2: fix, right? Because normally, if I want you to… to just write the answer, mostly I want… I want to just write the feedback.
|
|
|
|
627
|
|
01:41:40.340 --> 01:41:50.910
|
|
A1CE Lecture 2: about what you think about the question. So it's just like feedback that, okay, if I,
|
|
|
|
628
|
|
01:41:54.130 --> 01:42:06.060
|
|
A1CE Lecture 2: is there anything, that you not understand, or you correctly understand, or you not understand, or you're not really clear about some topic? So, I will use that,
|
|
|
|
629
|
|
01:42:06.890 --> 01:42:08.919
|
|
A1CE Lecture 2: That answer to just…
|
|
|
|
630
|
|
01:42:09.070 --> 01:42:21.540
|
|
A1CE Lecture 2: check what I can do, or what may be something that maybe I need to discuss a little bit more in detail in the next class or not, right? But okay, but I will provide that.
|
|
|
|
631
|
|
01:42:21.720 --> 01:42:27.170
|
|
A1CE Lecture 2: But for this week, for Google Form, because…
|
|
|
|
632
|
|
01:42:28.330 --> 01:42:40.700
|
|
A1CE Lecture 2: When you look at this, policy, right, it… it's quite… I will ask you that if…
|
|
|
|
633
|
|
01:42:41.000 --> 01:42:48.670
|
|
A1CE Lecture 2: if, if… But I will also say in the Google Form, if we don't have this.
|
|
|
|
634
|
|
01:42:48.770 --> 01:42:56.020
|
|
A1CE Lecture 2: I, I, I, I delete… These form the resource, form the policy.
|
|
|
|
635
|
|
01:42:57.740 --> 01:43:02.689
|
|
A1CE Lecture 2: Do you think the outcome's still the same, or different?
|
|
|
|
636
|
|
01:43:03.130 --> 01:43:03.840
|
|
A1CE Lecture 2: Right.
|
|
|
|
637
|
|
01:43:05.610 --> 01:43:16.140
|
|
A1CE Lecture 2: Because if you look… Briefly, Right? Is it quite… The same thing, right?
|
|
|
|
638
|
|
01:43:16.300 --> 01:43:25.489
|
|
A1CE Lecture 2: I think… Do you think that even we delete the… the… this part…
|
|
|
|
639
|
|
01:43:26.520 --> 01:43:36.830
|
|
A1CE Lecture 2: it's still the same, right? The outcome may be the same, but why? But why? The important is, there's two questions… two… two questions to answer.
|
|
|
|
640
|
|
01:43:37.070 --> 01:43:41.390
|
|
A1CE Lecture 2: For this is, If we remove this part.
|
|
|
|
641
|
|
01:43:42.110 --> 01:43:48.120
|
|
A1CE Lecture 2: is the result still the same, right? And if it's the same.
|
|
|
|
642
|
|
01:43:48.540 --> 01:43:50.939
|
|
A1CE Lecture 2: Why we need this statement.
|
|
|
|
643
|
|
01:43:51.870 --> 01:43:56.000
|
|
A1CE Lecture 2: That, that's what I,
|
|
|
|
644
|
|
01:43:56.170 --> 01:44:03.940
|
|
A1CE Lecture 2: want you to, research and answer, in the Google Form for, today, right?
|
|
|
|
645
|
|
01:44:04.940 --> 01:44:05.820
|
|
A1CE Lecture 2: Okay.
|
|
|
|
646
|
|
01:44:06.000 --> 01:44:07.680
|
|
A1CE Lecture 2: One more thing.
|
|
|
|
647
|
|
01:44:07.800 --> 01:44:18.360
|
|
A1CE Lecture 2: Because we're talking about the policy, that normally policy will have effect, action, resource, and condition. But in AWS,
|
|
|
|
648
|
|
01:44:19.580 --> 01:44:23.000
|
|
A1CE Lecture 2: In AWS, I am.
|
|
|
|
649
|
|
01:44:24.070 --> 01:44:29.600
|
|
A1CE Lecture 2: There's… 2… Type.
|
|
|
|
650
|
|
01:44:30.470 --> 01:44:33.529
|
|
A1CE Lecture 2: of IM policy.
|
|
|
|
651
|
|
01:44:34.860 --> 01:44:38.249
|
|
A1CE Lecture 2: The first one is identity-based.
|
|
|
|
652
|
|
01:44:40.690 --> 01:44:41.730
|
|
A1CE Lecture 2: Policy.
|
|
|
|
653
|
|
01:44:42.670 --> 01:44:45.739
|
|
A1CE Lecture 2: And the second one is resource-based.
|
|
|
|
654
|
|
01:44:51.030 --> 01:44:54.250
|
|
A1CE Lecture 2: But what is the difference?
|
|
|
|
655
|
|
01:44:54.420 --> 01:44:56.499
|
|
A1CE Lecture 2: It's based on the name, right?
|
|
|
|
656
|
|
01:44:56.680 --> 01:45:04.630
|
|
A1CE Lecture 2: Identity-based policy is the policy… policy… that… Attest.
|
|
|
|
657
|
|
01:45:06.020 --> 01:45:08.680
|
|
A1CE Lecture 2: with… Identity.
|
|
|
|
658
|
|
01:45:10.450 --> 01:45:18.420
|
|
A1CE Lecture 2: Right? And resource-based policy is Policy… that… Attached.
|
|
|
|
659
|
|
01:45:19.770 --> 01:45:27.430
|
|
A1CE Lecture 2: with… I highly… I… I have to highlight as…
|
|
|
|
660
|
|
01:45:28.090 --> 01:45:39.060
|
|
A1CE Lecture 2: Resource-based policy is policy that's attached with specific AWS, resources.
|
|
|
|
661
|
|
01:45:39.990 --> 01:45:48.000
|
|
A1CE Lecture 2: What specific mean is not every… AWS, Vsauce.
|
|
|
|
662
|
|
01:45:50.100 --> 01:45:50.960
|
|
A1CE Lecture 2: Support.
|
|
|
|
663
|
|
01:45:52.160 --> 01:46:00.810
|
|
A1CE Lecture 2: So, we can create policy, IAM policy, to attach with AWS resource that
|
|
|
|
664
|
|
01:46:01.060 --> 01:46:07.830
|
|
A1CE Lecture 2: support resource-based policy. Not every AWS service supports resource-based policy, right?
|
|
|
|
665
|
|
01:46:08.140 --> 01:46:15.519
|
|
A1CE Lecture 2: But identity-based policy is… You can use identity-based policy to attach with
|
|
|
|
666
|
|
01:46:16.660 --> 01:46:22.200
|
|
A1CE Lecture 2: or AWS identity. I am user, I am, bro.
|
|
|
|
667
|
|
01:46:22.470 --> 01:46:31.760
|
|
A1CE Lecture 2: and I am user group, right? You can attach identity-based policy with all type of identity that… that you have.
|
|
|
|
668
|
|
01:46:31.870 --> 01:46:32.530
|
|
A1CE Lecture 2: Bye.
|
|
|
|
669
|
|
01:46:33.670 --> 01:46:34.640
|
|
A1CE Lecture 2: But…
|
|
|
|
670
|
|
01:46:35.180 --> 01:46:47.020
|
|
A1CE Lecture 2: how we can tell, because the syntax of identity… identity-based policy and resource-based policy is quite… is really similar. The main difference is
|
|
|
|
671
|
|
01:46:47.290 --> 01:46:49.399
|
|
A1CE Lecture 2: For resource bankruptcy?
|
|
|
|
672
|
|
01:46:49.720 --> 01:46:55.610
|
|
A1CE Lecture 2: You have to specify Principal?
|
|
|
|
673
|
|
01:46:59.280 --> 01:47:00.620
|
|
A1CE Lecture 2: In the policy.
|
|
|
|
674
|
|
01:47:01.450 --> 01:47:02.120
|
|
A1CE Lecture 2: Right.
|
|
|
|
675
|
|
01:47:03.530 --> 01:47:08.790
|
|
A1CE Lecture 2: So, go back to have a loop, right? This is identity-based policy.
|
|
|
|
676
|
|
01:47:09.030 --> 01:47:11.760
|
|
A1CE Lecture 2: And if it's resource-based… oh!
|
|
|
|
677
|
|
01:47:13.140 --> 01:47:21.390
|
|
A1CE Lecture 2: these examples, This example is… is not correct, because if it said that this is resource-based policy.
|
|
|
|
678
|
|
01:47:21.740 --> 01:47:34.719
|
|
A1CE Lecture 2: it does not have principle, right? Because every resource-based policy You have to specify… principle, right? So, this one.
|
|
|
|
679
|
|
01:47:37.050 --> 01:47:49.839
|
|
A1CE Lecture 2: Is correct, because if we have to use resource-based policy, in policy statement of resource-based policy, you have to specify principle.
|
|
|
|
680
|
|
01:47:51.010 --> 01:47:56.730
|
|
A1CE Lecture 2: And this not have principles, so this is not… Correct.
|
|
|
|
681
|
|
01:47:57.330 --> 01:47:58.120
|
|
A1CE Lecture 2: Right?
|
|
|
|
682
|
|
01:47:58.700 --> 01:48:00.470
|
|
A1CE Lecture 2: Need to…
|
|
|
|
683
|
|
01:48:03.560 --> 01:48:04.720
|
|
A1CE Lecture 2: Principal?
|
|
|
|
684
|
|
01:48:06.940 --> 01:48:09.279
|
|
A1CE Lecture 2: In syntax, right?
|
|
|
|
685
|
|
01:48:09.600 --> 01:48:13.859
|
|
A1CE Lecture 2: That if it's just like this, not correct.
|
|
|
|
686
|
|
01:48:15.450 --> 01:48:16.700
|
|
A1CE Lecture 2: This one is correct.
|
|
|
|
687
|
|
01:48:16.950 --> 01:48:25.060
|
|
A1CE Lecture 2: principle in the resource-based policy is required, right? But… SID.
|
|
|
|
688
|
|
01:48:26.620 --> 01:48:31.560
|
|
A1CE Lecture 2: SID is… it's just like… Commit.
|
|
|
|
689
|
|
01:48:32.090 --> 01:48:45.459
|
|
A1CE Lecture 2: Right? So, you can have SID in the policy statement, or you don't have to provide SID in the policy statement. It's okay, right?
|
|
|
|
690
|
|
01:48:47.290 --> 01:48:54.840
|
|
A1CE Lecture 2: So, this one don't have SID, so… but it's okay, right? It depends, right? But I…
|
|
|
|
691
|
|
01:48:55.450 --> 01:49:11.280
|
|
A1CE Lecture 2: suggest, if you write IAM policy, I suggest you to provide SID, right? Because it's just like command, right? So, so we can say that this is… SID is called B access 1.
|
|
|
|
692
|
|
01:49:11.630 --> 01:49:18.470
|
|
A1CE Lecture 2: It may not looking good, but at least I know this is policy for ECOB.
|
|
|
|
693
|
|
01:49:18.570 --> 01:49:37.680
|
|
A1CE Lecture 2: Right? But I don't know… I do not know what it acts as one, but at least I get some information that what this policy is used for, right? So, if we create a policy, and this policy may be used
|
|
|
|
694
|
|
01:49:38.840 --> 01:49:40.520
|
|
A1CE Lecture 2: by many people.
|
|
|
|
695
|
|
01:49:40.640 --> 01:49:43.550
|
|
A1CE Lecture 2: Provide SID definition.
|
|
|
|
696
|
|
01:49:43.870 --> 01:49:51.430
|
|
A1CE Lecture 2: Especially what this policy is designed for will be very useful, right?
|
|
|
|
697
|
|
01:49:51.920 --> 01:49:58.689
|
|
A1CE Lecture 2: Okay, and this is a thing All of, the important
|
|
|
|
698
|
|
01:50:00.060 --> 01:50:11.069
|
|
A1CE Lecture 2: access control, right? We're talking about authentication, right? We… In summary, right, we… In summary…
|
|
|
|
699
|
|
01:50:13.660 --> 01:50:25.879
|
|
A1CE Lecture 2: We're talking about all of, basic of access control. We're talking about authentication, we're talking about, what is long-term.
|
|
|
|
700
|
|
01:50:26.900 --> 01:50:28.850
|
|
A1CE Lecture 2: Identity, right?
|
|
|
|
701
|
|
01:50:29.720 --> 01:50:31.150
|
|
A1CE Lecture 2: I am user.
|
|
|
|
702
|
|
01:50:31.290 --> 01:50:39.570
|
|
A1CE Lecture 2: Right? And also, we're talking about two types of long-term credential. Long term.
|
|
|
|
703
|
|
01:50:40.650 --> 01:50:42.129
|
|
A1CE Lecture 2: Credential 1.
|
|
|
|
704
|
|
01:50:42.310 --> 01:50:44.979
|
|
A1CE Lecture 2: Long-term KDSGNF tool, password.
|
|
|
|
705
|
|
01:50:46.550 --> 01:50:48.960
|
|
A1CE Lecture 2: And… programmatic access.
|
|
|
|
706
|
|
01:50:50.790 --> 01:50:57.470
|
|
A1CE Lecture 2: Right? So, to highlight…
|
|
|
|
707
|
|
01:51:02.990 --> 01:51:11.940
|
|
A1CE Lecture 2: 2… Pre-protect.
|
|
|
|
708
|
|
01:51:14.270 --> 01:51:21.759
|
|
A1CE Lecture 2: from… compromise, right? Just loaded the password, or something like that.
|
|
|
|
709
|
|
01:51:22.480 --> 01:51:28.809
|
|
A1CE Lecture 2: And we're also talking about, short-term identity.
|
|
|
|
710
|
|
01:51:31.850 --> 01:51:34.420
|
|
A1CE Lecture 2: Which is, IAM role.
|
|
|
|
711
|
|
01:51:34.990 --> 01:51:35.700
|
|
A1CE Lecture 2: Bye.
|
|
|
|
712
|
|
01:51:36.140 --> 01:51:43.310
|
|
A1CE Lecture 2: And… working with, AWS, STS.
|
|
|
|
713
|
|
01:51:43.500 --> 01:51:47.670
|
|
A1CE Lecture 2: 4… Temporary token?
|
|
|
|
714
|
|
01:51:48.900 --> 01:51:53.699
|
|
A1CE Lecture 2: And we're talking about authorization.
|
|
|
|
715
|
|
01:51:57.110 --> 01:52:00.000
|
|
A1CE Lecture 2: Awe?
|
|
|
|
716
|
|
01:52:00.590 --> 01:52:06.170
|
|
A1CE Lecture 2: Policy… Evaluate.
|
|
|
|
717
|
|
01:52:08.670 --> 01:52:13.880
|
|
A1CE Lecture 2: And what, explicit.
|
|
|
|
718
|
|
01:52:15.530 --> 01:52:16.720
|
|
A1CE Lecture 2: Deny?
|
|
|
|
719
|
|
01:52:17.970 --> 01:52:19.650
|
|
A1CE Lecture 2: to explicit.
|
|
|
|
720
|
|
01:52:20.800 --> 01:52:21.850
|
|
A1CE Lecture 2: Allow.
|
|
|
|
721
|
|
01:52:22.640 --> 01:52:26.019
|
|
A1CE Lecture 2: And the last one is MPC deny.
|
|
|
|
722
|
|
01:52:28.280 --> 01:52:35.580
|
|
A1CE Lecture 2: And… Resource-based policy?
|
|
|
|
723
|
|
01:52:40.430 --> 01:52:45.260
|
|
A1CE Lecture 2: Must… have… Principal?
|
|
|
|
724
|
|
01:52:46.860 --> 01:52:58.339
|
|
A1CE Lecture 2: Right? And last thing is, I am… I, not I am, sorry.
|
|
|
|
725
|
|
01:53:00.160 --> 01:53:12.000
|
|
A1CE Lecture 2: What we have is that you need to know identity, that… Aws, Support.
|
|
|
|
726
|
|
01:53:12.260 --> 01:53:12.980
|
|
A1CE Lecture 2: Right.
|
|
|
|
727
|
|
01:53:13.750 --> 01:53:17.120
|
|
A1CE Lecture 2: I am… Do you, sir?
|
|
|
|
728
|
|
01:53:17.690 --> 01:53:21.490
|
|
A1CE Lecture 2: I am… blow.
|
|
|
|
729
|
|
01:53:21.670 --> 01:53:26.620
|
|
A1CE Lecture 2: I, I am… User group?
|
|
|
|
730
|
|
01:53:28.560 --> 01:53:32.550
|
|
A1CE Lecture 2: and… AWS, service.
|
|
|
|
731
|
|
01:53:34.800 --> 01:53:40.580
|
|
A1CE Lecture 2: AWS… Echo… producer.
|
|
|
|
732
|
|
01:53:41.870 --> 01:53:45.599
|
|
A1CE Lecture 2: And… lastly, federate user.
|
|
|
|
733
|
|
01:53:48.990 --> 01:53:49.770
|
|
A1CE Lecture 2: Alright.
|
|
|
|
734
|
|
01:53:49.930 --> 01:53:58.020
|
|
A1CE Lecture 2: So, this is identity that AWS supports, and… Oli?
|
|
|
|
735
|
|
01:53:58.860 --> 01:54:02.170
|
|
A1CE Lecture 2: I am user… Group.
|
|
|
|
736
|
|
01:54:03.440 --> 01:54:07.770
|
|
A1CE Lecture 2: is not principle, right?
|
|
|
|
737
|
|
01:54:08.130 --> 01:54:10.920
|
|
A1CE Lecture 2: So, this is important because, at least.
|
|
|
|
738
|
|
01:54:12.480 --> 01:54:21.829
|
|
A1CE Lecture 2: For resource-based policy, you must specify principle, so you know what is principle that you can specify in resource-based policy.
|
|
|
|
739
|
|
01:54:22.040 --> 01:54:37.540
|
|
A1CE Lecture 2: Principal can be IAM user, can be IAM role, can be AWS service, can be AWS a CalRude user, and can be Federal Red user. But even I say that principal is AWS a call root user, but
|
|
|
|
740
|
|
01:54:38.040 --> 01:54:52.130
|
|
A1CE Lecture 2: I think we… we will not specify, or it's gonna be… I never use, AWS Account Reducer in any resource-based policy, right? Because for resource-based policy, you can control
|
|
|
|
741
|
|
01:54:52.240 --> 01:54:58.189
|
|
A1CE Lecture 2: which principal can access the resource by specifying IAM user.
|
|
|
|
742
|
|
01:54:58.740 --> 01:55:12.289
|
|
A1CE Lecture 2: or specify IAM role, or you specify AWS service, right? Normally, AWS service, what you can specify, AWS service in the principle, mostly.
|
|
|
|
743
|
|
01:55:12.630 --> 01:55:21.609
|
|
A1CE Lecture 2: most of the results in AWS there we have… something called ARN number, right?
|
|
|
|
744
|
|
01:55:21.830 --> 01:55:27.020
|
|
A1CE Lecture 2: And for AI in number is… a Maison.
|
|
|
|
745
|
|
01:55:27.660 --> 01:55:28.870
|
|
A1CE Lecture 2: resource.
|
|
|
|
746
|
|
01:55:29.940 --> 01:55:30.790
|
|
A1CE Lecture 2: Number.
|
|
|
|
747
|
|
01:55:31.680 --> 01:55:32.350
|
|
A1CE Lecture 2: Right.
|
|
|
|
748
|
|
01:55:33.060 --> 01:55:47.169
|
|
A1CE Lecture 2: So, normally, when you specify AWS service, AWS, AM user, AM role, and AM role, normally you use AI and number, right? Normally, but
|
|
|
|
749
|
|
01:55:47.330 --> 01:55:55.720
|
|
A1CE Lecture 2: In some cases, you may have another identification, but mostly, in many cases, it's gonna be AIIN number, right?
|
|
|
|
750
|
|
01:55:56.470 --> 01:56:03.680
|
|
A1CE Lecture 2: Okay, and let me, check…
|
|
|
|
751
|
|
01:56:04.130 --> 01:56:05.919
|
|
A1CE Lecture 2: Let me go back a little bit.
|
|
|
|
752
|
|
01:56:06.530 --> 01:56:14.789
|
|
A1CE Lecture 2: What I have to… Okay, I think one of,
|
|
|
|
753
|
|
01:56:14.790 --> 01:56:26.869
|
|
A1CE Lecture 2: IAM role uses is… you… you can think about, in many situations. For example, if I explain this diagram, so we have two AWS accounts.
|
|
|
|
754
|
|
01:56:26.870 --> 01:56:33.390
|
|
A1CE Lecture 2: Right? You have AWS account 1, right? AWS account 2, right? But if you want
|
|
|
|
755
|
|
01:56:33.520 --> 01:56:43.540
|
|
A1CE Lecture 2: if I am a user, for example, this is, for me as the School of IT, right? This is CMKL, right?
|
|
|
|
756
|
|
01:56:43.540 --> 01:56:55.359
|
|
A1CE Lecture 2: So, if I… I already have, I am user in the School of IT, but if I'm gonna work for CMKL as a part-time.
|
|
|
|
757
|
|
01:56:55.400 --> 01:57:01.719
|
|
A1CE Lecture 2: So, I… I want to exit the resource in AWS Echo 1, but because
|
|
|
|
758
|
|
01:57:01.930 --> 01:57:07.369
|
|
A1CE Lecture 2: I am identity in another account. So, by default.
|
|
|
|
759
|
|
01:57:07.550 --> 01:57:11.390
|
|
A1CE Lecture 2: Different account, yes, we cannot access.
|
|
|
|
760
|
|
01:57:11.630 --> 01:57:21.540
|
|
A1CE Lecture 2: the resource in another account. So, when I work part-time with CMKL, what the CMKL admin have to do is…
|
|
|
|
761
|
|
01:57:22.330 --> 01:57:24.589
|
|
A1CE Lecture 2: CMKL admin create.
|
|
|
|
762
|
|
01:57:25.300 --> 01:57:29.760
|
|
A1CE Lecture 2: I am role, right? I am role that's for me to use, right?
|
|
|
|
763
|
|
01:57:29.950 --> 01:57:39.399
|
|
A1CE Lecture 2: And they assign, the policy, right? So aside the policy, any policy that, okay, I can maybe read.
|
|
|
|
764
|
|
01:57:39.700 --> 01:57:41.660
|
|
A1CE Lecture 2: H3 bucket.
|
|
|
|
765
|
|
01:57:42.000 --> 01:57:49.839
|
|
A1CE Lecture 2: policy, right? And what I can do is I can assume, right? But before I can assume.
|
|
|
|
766
|
|
01:57:49.980 --> 01:57:55.109
|
|
A1CE Lecture 2: I have to set that in this role, allow.
|
|
|
|
767
|
|
01:57:57.320 --> 01:58:09.070
|
|
A1CE Lecture 2: I have to say that this role allowed to be Assume… by… act cow… 2.
|
|
|
|
768
|
|
01:58:09.360 --> 01:58:10.810
|
|
A1CE Lecture 2: And…
|
|
|
|
769
|
|
01:58:11.030 --> 01:58:24.700
|
|
A1CE Lecture 2: not only at how to, and I said that at Cal2, and also I am user account 2, right? I have to set that, okay, this role can be assumed by this
|
|
|
|
770
|
|
01:58:24.860 --> 01:58:28.679
|
|
A1CE Lecture 2: identity, right? So, when I try to assume.
|
|
|
|
771
|
|
01:58:28.790 --> 01:58:35.309
|
|
A1CE Lecture 2: Okay, it will check that, oh, okay, this role can be assumed by this, and when I assume.
|
|
|
|
772
|
|
01:58:35.650 --> 01:58:47.060
|
|
A1CE Lecture 2: I get temporary access, right? So, I can request or access the data that is in S3 bucket, because I can assume this role. And
|
|
|
|
773
|
|
01:58:47.060 --> 01:58:55.700
|
|
A1CE Lecture 2: It's also the same if this is CMKL and School of IT. I may form other, maybe I'm from…
|
|
|
|
774
|
|
01:58:57.260 --> 01:58:58.170
|
|
A1CE Lecture 2: Cisco.
|
|
|
|
775
|
|
01:58:58.380 --> 01:59:13.120
|
|
A1CE Lecture 2: outside, not AWS account. Maybe from Cisco, Cisco, okay, another domain, and if I want to do that, yes, possible, right? If I just say that, okay, this account can be assumed by
|
|
|
|
776
|
|
01:59:13.400 --> 01:59:18.140
|
|
A1CE Lecture 2: Cisco, right? Cisco domain is possible, but it's a little bit…
|
|
|
|
777
|
|
01:59:18.690 --> 01:59:23.629
|
|
A1CE Lecture 2: tricky, right? You have to set IM, right?
|
|
|
|
778
|
|
01:59:23.760 --> 01:59:28.619
|
|
A1CE Lecture 2: And… you want to make sure that I am of this AWS account.
|
|
|
|
779
|
|
01:59:29.580 --> 01:59:37.219
|
|
A1CE Lecture 2: can communicate with Cisco Identity Server, right? So, if we can connect
|
|
|
|
780
|
|
01:59:37.380 --> 01:59:41.459
|
|
A1CE Lecture 2: I am in our AWS account to Cisco server.
|
|
|
|
781
|
|
01:59:42.240 --> 01:59:49.469
|
|
A1CE Lecture 2: When we… when I tried to log in, I just said, okay, my name is Lapad at Cisco.com.
|
|
|
|
782
|
|
01:59:50.350 --> 02:00:02.580
|
|
A1CE Lecture 2: And this is my password. And the IAM of my account can check with the Cisco server, and if I authent, pass, I can access AWS environment.
|
|
|
|
783
|
|
02:00:02.700 --> 02:00:04.860
|
|
A1CE Lecture 2: Using IAM rule.
|
|
|
|
784
|
|
02:00:05.230 --> 02:00:10.060
|
|
A1CE Lecture 2: And I will have temporary access, right?
|
|
|
|
785
|
|
02:00:10.560 --> 02:00:16.759
|
|
A1CE Lecture 2: So… Next, I will want you to,
|
|
|
|
786
|
|
02:00:16.880 --> 02:00:24.070
|
|
A1CE Lecture 2: try to access. So, make sure… I'm not sure that I have to log in again, yes?
|
|
|
|
787
|
|
02:00:24.510 --> 02:00:28.460
|
|
A1CE Lecture 2: Okay, so, the next part is…
|
|
|
|
788
|
|
02:00:28.780 --> 02:00:36.470
|
|
A1CE Lecture 2: Because we… we already finished the lecture, but… This week, you will have…
|
|
|
|
789
|
|
02:00:36.950 --> 02:00:39.399
|
|
A1CE Lecture 2: You would have to do the lab, right?
|
|
|
|
790
|
|
02:00:39.620 --> 02:00:45.260
|
|
A1CE Lecture 2: So… I will… Explain.
|
|
|
|
791
|
|
02:00:45.500 --> 02:00:50.410
|
|
A1CE Lecture 2: How to use AWS Academy.
|
|
|
|
792
|
|
02:00:50.590 --> 02:00:54.290
|
|
A1CE Lecture 2: resource, right? And you have to do the lab.
|
|
|
|
793
|
|
02:00:54.560 --> 02:01:03.430
|
|
A1CE Lecture 2: Let's make sure that I enter… Okay.
|
|
|
|
794
|
|
02:01:07.050 --> 02:01:08.210
|
|
A1CE Lecture 2: Okay…
|
|
|
|
795
|
|
02:01:26.970 --> 02:01:31.249
|
|
A1CE Lecture 2: Okay, let's go through the cause.
|
|
|
|
796
|
|
02:01:34.280 --> 02:01:36.630
|
|
A1CE Lecture 2: Okay, this one.
|
|
|
|
797
|
|
02:01:40.790 --> 02:01:42.350
|
|
A1CE Lecture 2: Okay,
|
|
|
|
798
|
|
02:01:43.160 --> 02:01:49.940
|
|
A1CE Lecture 2: We will go to do the lab for this week, one of the assignments, apart from,
|
|
|
|
799
|
|
02:01:50.340 --> 02:02:02.210
|
|
A1CE Lecture 2: the Google Form, that I will provide to you, I think maybe at the end of today, or maybe tomorrow. What you have to do for this week is GuideLab.
|
|
|
|
800
|
|
02:02:02.410 --> 02:02:09.220
|
|
A1CE Lecture 2: Right? Explore AWS Identity and Access Management, and Module 3, Knowledge Check, right?
|
|
|
|
801
|
|
02:02:09.610 --> 02:02:18.120
|
|
A1CE Lecture 2: Okay, just when you want to… if you want to do the lab, you just click to this, guide lab, right?
|
|
|
|
802
|
|
02:02:23.730 --> 02:02:26.490
|
|
A1CE Lecture 2: And it will take you to the lab.
|
|
|
|
803
|
|
02:02:26.760 --> 02:02:30.990
|
|
A1CE Lecture 2: But for me, it just feels more click, because I'm,
|
|
|
|
804
|
|
02:02:31.290 --> 02:02:36.860
|
|
A1CE Lecture 2: I am teacher of this class, so I have to access the student view first.
|
|
|
|
805
|
|
02:02:37.130 --> 02:02:39.199
|
|
A1CE Lecture 2: But when you click at the Kylab.
|
|
|
|
806
|
|
02:02:39.360 --> 02:02:42.660
|
|
A1CE Lecture 2: It will take you to this,
|
|
|
|
807
|
|
02:02:43.930 --> 02:02:49.699
|
|
A1CE Lecture 2: AWS, Academy Lab environment. Spokello, right?
|
|
|
|
808
|
|
02:02:49.870 --> 02:02:55.680
|
|
A1CE Lecture 2: The first thing, when you enter the lab, right, the instruction?
|
|
|
|
809
|
|
02:02:55.840 --> 02:02:59.179
|
|
A1CE Lecture 2: It will provide if it's a guide lab.
|
|
|
|
810
|
|
02:03:00.000 --> 02:03:11.800
|
|
A1CE Lecture 2: The detailed instruction will be provided, so you can just follow the step, right? But for this lab, I think it requires you to use private tab.
|
|
|
|
811
|
|
02:03:12.050 --> 02:03:12.770
|
|
A1CE Lecture 2: Right.
|
|
|
|
812
|
|
02:03:13.690 --> 02:03:18.919
|
|
A1CE Lecture 2: And… When you try to…
|
|
|
|
813
|
|
02:03:19.550 --> 02:03:32.859
|
|
A1CE Lecture 2: want to do the lab, the first thing that you have to do is start the lab, because, is there a red dots here? It means that it's still not ready, so we have to start the lab first. Click start the lab.
|
|
|
|
814
|
|
02:03:33.640 --> 02:03:38.729
|
|
A1CE Lecture 2: And… with… A little bit, so it will change…
|
|
|
|
815
|
|
02:03:39.590 --> 02:03:50.929
|
|
A1CE Lecture 2: from red to yellow, and to green, right? If it changes to green, this means that the lab environment is ready, right?
|
|
|
|
816
|
|
02:03:52.150 --> 02:04:03.599
|
|
A1CE Lecture 2: So, we wait a little bit. So, but right now, you may see that you have time, right? 3 hours, right? It means, the envelopment for this lab
|
|
|
|
817
|
|
02:04:03.750 --> 02:04:14.360
|
|
A1CE Lecture 2: will be available for 3 hours, right? If it reaches zero, it means everything will be terminated, right?
|
|
|
|
818
|
|
02:04:15.160 --> 02:04:17.259
|
|
A1CE Lecture 2: So we wait.
|
|
|
|
819
|
|
02:04:18.010 --> 02:04:20.319
|
|
A1CE Lecture 2: Right? We wait,
|
|
|
|
820
|
|
02:04:26.200 --> 02:04:39.110
|
|
A1CE Lecture 2: Until the lab is ready. So, it will take, normally, in most labs, it will take about, within 5 minutes to set up the lab environment.
|
|
|
|
821
|
|
02:04:42.180 --> 02:04:45.279
|
|
A1CE Lecture 2: So, just waiting a little bit.
|
|
|
|
822
|
|
02:04:48.780 --> 02:04:58.790
|
|
A1CE Lecture 2: And… You can see here that, after you finish the lab, you have to click Submit.
|
|
|
|
823
|
|
02:04:59.070 --> 02:05:09.270
|
|
A1CE Lecture 2: Right? Submit, we'll, mark, what you have to do in the lab. If you do everything correct, you will get
|
|
|
|
824
|
|
02:05:09.600 --> 02:05:20.909
|
|
A1CE Lecture 2: full mark for all the submission, and it will be record in this, AWS Academy, portal, right? So I can check. And…
|
|
|
|
825
|
|
02:05:20.990 --> 02:05:31.100
|
|
A1CE Lecture 2: for this course, as Matt asked, but I also will specify in, CMK or Canvas, that for lab and knowledge check.
|
|
|
|
826
|
|
02:05:31.480 --> 02:05:36.370
|
|
A1CE Lecture 2: You have to get 80%
|
|
|
|
827
|
|
02:05:36.800 --> 02:05:46.459
|
|
A1CE Lecture 2: or more, right? More than… it's at least 80% or more. If you get the marking for…
|
|
|
|
828
|
|
02:05:46.680 --> 02:06:01.189
|
|
A1CE Lecture 2: each lab that I assign, and you get 80%, and also the knowledge check, you get 80% or more, you get full score, right? Full score for that assignment, right?
|
|
|
|
829
|
|
02:06:01.980 --> 02:06:09.739
|
|
A1CE Lecture 2: Okay, when this is changed to green, it means the lab is ready, right?
|
|
|
|
830
|
|
02:06:09.960 --> 02:06:17.599
|
|
A1CE Lecture 2: You can click this, it's not a button, but yes, you can click this, to open
|
|
|
|
831
|
|
02:06:18.250 --> 02:06:26.009
|
|
A1CE Lecture 2: the new browser, and this is the AWS Management Console that you can use to do the lab.
|
|
|
|
832
|
|
02:06:26.180 --> 02:06:35.420
|
|
A1CE Lecture 2: If it's not specified, please make sure that you do the lab in
|
|
|
|
833
|
|
02:06:35.560 --> 02:06:48.459
|
|
A1CE Lecture 2: US East 1 region, or North Virginia, right? Make sure that the AWS Management Console is in US East 1, or North Virginia.
|
|
|
|
834
|
|
02:06:48.580 --> 02:06:57.550
|
|
A1CE Lecture 2: You may need to work in another AWS region, but only if
|
|
|
|
835
|
|
02:06:57.710 --> 02:07:03.669
|
|
A1CE Lecture 2: Another region to use is specified in the lab instruction.
|
|
|
|
836
|
|
02:07:03.850 --> 02:07:09.260
|
|
A1CE Lecture 2: So, if lab instruction Do not specify anything.
|
|
|
|
837
|
|
02:07:09.800 --> 02:07:14.720
|
|
A1CE Lecture 2: Make sure that you use AWS that…
|
|
|
|
838
|
|
02:07:15.030 --> 02:07:28.959
|
|
A1CE Lecture 2: only in Northern Virginia, right, or US is one. But 99.9% of the time, when you access the web console, management console for the lab, it will be at North Virginia region.
|
|
|
|
839
|
|
02:07:30.240 --> 02:07:32.680
|
|
A1CE Lecture 2: So, just make sure, right?
|
|
|
|
840
|
|
02:07:34.940 --> 02:07:38.419
|
|
A1CE Lecture 2: One thing that I have to,
|
|
|
|
841
|
|
02:07:38.560 --> 02:07:47.579
|
|
A1CE Lecture 2: show is… you can see here, right, on the right, top right of the browser, And you click.
|
|
|
|
842
|
|
02:07:50.040 --> 02:07:56.489
|
|
A1CE Lecture 2: You will see that you log in to this AWS environment using Federate User.
|
|
|
|
843
|
|
02:07:56.980 --> 02:08:01.470
|
|
A1CE Lecture 2: Right? So, we already learned about that today. So…
|
|
|
|
844
|
|
02:08:02.060 --> 02:08:12.780
|
|
A1CE Lecture 2: what… what does it mean, right? You enter this AWS account by using Identity, form.
|
|
|
|
845
|
|
02:08:13.290 --> 02:08:17.119
|
|
A1CE Lecture 2: the domain outside AWS. But which domain?
|
|
|
|
846
|
|
02:08:18.120 --> 02:08:29.340
|
|
A1CE Lecture 2: this domain, right? You enter AWS environment using AWS Academy identity, right? So right now, what
|
|
|
|
847
|
|
02:08:29.750 --> 02:08:44.459
|
|
A1CE Lecture 2: AWS Academy do in the back end is AWS Academy has a database account for the lab environment, and they config what I explained to you, right, in this slide.
|
|
|
|
848
|
|
02:08:44.570 --> 02:08:51.540
|
|
A1CE Lecture 2: That… This is, if I'm gonna say it, this is… AWS… Academy?
|
|
|
|
849
|
|
02:08:51.660 --> 02:08:58.770
|
|
A1CE Lecture 2: which is not AWS account, right? We are the outside of AWS environment. And for…
|
|
|
|
850
|
|
02:08:58.890 --> 02:09:05.159
|
|
A1CE Lecture 2: doing the lab for each of you, AWS Academy has multiple AWS accounts.
|
|
|
|
851
|
|
02:09:05.390 --> 02:09:12.839
|
|
A1CE Lecture 2: And it already connects identity access management of this account to AWS Academy.
|
|
|
|
852
|
|
02:09:12.920 --> 02:09:25.659
|
|
A1CE Lecture 2: So, when you log in, right now, you are logged in as the federate user, and you assume the role in this AWS account.
|
|
|
|
853
|
|
02:09:26.470 --> 02:09:32.480
|
|
A1CE Lecture 2: Why… why I can say that we assume the role, right? Because…
|
|
|
|
854
|
|
02:09:35.850 --> 02:09:36.560
|
|
A1CE Lecture 2: Yes.
|
|
|
|
855
|
|
02:09:36.980 --> 02:09:47.360
|
|
A1CE Lecture 2: there's time limit, right? So, that's… that is one of things that you can see, right? Right now, we are outside of AWS.
|
|
|
|
856
|
|
02:09:47.560 --> 02:10:00.010
|
|
A1CE Lecture 2: Right? And we enter AWS, so we using temporary access, right? You… we already using temporary access, because we just can't use this for
|
|
|
|
857
|
|
02:10:01.200 --> 02:10:14.159
|
|
A1CE Lecture 2: specific period of time. So this is not default value. This is 3 hours, right? But I think I use AWS Academy for 6 years now. As forb is 4 hours.
|
|
|
|
858
|
|
02:10:14.380 --> 02:10:30.930
|
|
A1CE Lecture 2: For every lap, it's 4 hours. But that is because 6 years ago, the default value for temporary token is 4 hours. It's 4 hours, it's 8 hours, and right now it's 12 hours, right? I don't know.
|
|
|
|
859
|
|
02:10:31.150 --> 02:10:36.910
|
|
A1CE Lecture 2: I don't know what it's gonna be in the next 2 years, right? But…
|
|
|
|
860
|
|
02:10:37.140 --> 02:10:45.610
|
|
A1CE Lecture 2: This is the lab environment, right? So, okay, so you have 3 hours. One thing that…
|
|
|
|
861
|
|
02:10:45.740 --> 02:10:59.969
|
|
A1CE Lecture 2: If you want to go to lunch, and you want to come back to do the lab, continue to do the lab, but you're afraid that the time limit will be reached zero, you can click start again to
|
|
|
|
862
|
|
02:11:00.270 --> 02:11:11.939
|
|
A1CE Lecture 2: renew the session, right? So you can start again. And it will renew something like this, and it will change back to 3 hours, right?
|
|
|
|
863
|
|
02:11:12.600 --> 02:11:21.370
|
|
A1CE Lecture 2: So, you can, renew if you want, right? We'll just extend the session. And…
|
|
|
|
864
|
|
02:11:21.810 --> 02:11:28.629
|
|
A1CE Lecture 2: Another thing, is I want you have to look at AWS detail here, then you can click.
|
|
|
|
865
|
|
02:11:29.890 --> 02:11:43.159
|
|
A1CE Lecture 2: And it will provide information. For example, if you don't want to use Management Console, you want to connect to AWS envelopment of the lab using CLI,
|
|
|
|
866
|
|
02:11:43.480 --> 02:11:49.640
|
|
A1CE Lecture 2: You can use this setup access key, secret access key, and session token.
|
|
|
|
867
|
|
02:11:49.730 --> 02:12:07.830
|
|
A1CE Lecture 2: Right? You copy that, and, to the credential file in the AWS directory, if you install AWS CLI, it will create this part, right? And you will copy this and paste into the credential file, and you can use that, but
|
|
|
|
868
|
|
02:12:07.830 --> 02:12:11.520
|
|
A1CE Lecture 2: It only can use for this session.
|
|
|
|
869
|
|
02:12:11.960 --> 02:12:12.630
|
|
A1CE Lecture 2: Right.
|
|
|
|
870
|
|
02:12:12.990 --> 02:12:16.389
|
|
A1CE Lecture 2: So, if you… Click start again.
|
|
|
|
871
|
|
02:12:16.790 --> 02:12:18.179
|
|
A1CE Lecture 2: This is renew.
|
|
|
|
872
|
|
02:12:18.300 --> 02:12:21.989
|
|
A1CE Lecture 2: And it chained, right? So make sure that… that…
|
|
|
|
873
|
|
02:12:22.040 --> 02:12:25.960
|
|
A1CE Lecture 2: So this is for command line interface, right? And…
|
|
|
|
874
|
|
02:12:25.980 --> 02:12:44.980
|
|
A1CE Lecture 2: In some labs, you will ask about the secure share key. If you install it in the EC2, you can download it here, right? Anything that you want to use, you can download it here, or you want to share your session with your friends, you can download this URL.
|
|
|
|
875
|
|
02:12:45.510 --> 02:12:46.280
|
|
A1CE Lecture 2: Bye.
|
|
|
|
876
|
|
02:12:47.500 --> 02:12:55.740
|
|
A1CE Lecture 2: And also, send this URL to your friends, but… And you can just…
|
|
|
|
877
|
|
02:12:59.410 --> 02:13:02.600
|
|
A1CE Lecture 2: enter the environment. The same environment.
|
|
|
|
878
|
|
02:13:03.540 --> 02:13:04.550
|
|
A1CE Lecture 2: As you.
|
|
|
|
879
|
|
02:13:04.730 --> 02:13:10.040
|
|
A1CE Lecture 2: As you use, that you can share. But normally, this is individual.
|
|
|
|
880
|
|
02:13:10.280 --> 02:13:24.079
|
|
A1CE Lecture 2: So, normally you don't want to share this, because what your friend do with this management console will also, in the same environment that you work with, so it's gonna be a problem, because,
|
|
|
|
881
|
|
02:13:25.220 --> 02:13:31.420
|
|
A1CE Lecture 2: you can submit. So, for example, if you finish, you do everything, And…
|
|
|
|
882
|
|
02:13:31.770 --> 02:13:47.670
|
|
A1CE Lecture 2: I make sure that if they specify to config anything, make sure that you config everything based on what the instruction tells you to do. If they want to say that
|
|
|
|
883
|
|
02:13:47.880 --> 02:13:48.790
|
|
A1CE Lecture 2: Please?
|
|
|
|
884
|
|
02:13:49.020 --> 02:13:53.540
|
|
A1CE Lecture 2: using the name S3 Support for something like this.
|
|
|
|
885
|
|
02:13:54.030 --> 02:13:59.310
|
|
A1CE Lecture 2: capital S, everything have to be matched, because when you submit
|
|
|
|
886
|
|
02:13:59.460 --> 02:14:02.900
|
|
A1CE Lecture 2: it's just like Python script to check the name.
|
|
|
|
887
|
|
02:14:03.050 --> 02:14:13.140
|
|
A1CE Lecture 2: And if the name, even the name is similar, but it's not capital letter, it will say that this is a different resource, and it will mark you zero.
|
|
|
|
888
|
|
02:14:13.250 --> 02:14:18.740
|
|
A1CE Lecture 2: Right? So make sure that you follow the instruction closely, right?
|
|
|
|
889
|
|
02:14:19.560 --> 02:14:22.770
|
|
A1CE Lecture 2: And when you submit, Click Submit.
|
|
|
|
890
|
|
02:14:23.250 --> 02:14:36.489
|
|
A1CE Lecture 2: And you can submit anytime, right? So, if you submit and it's still not full score, and you can make a change, because, in the submission report, it will provide
|
|
|
|
891
|
|
02:14:37.500 --> 02:14:44.750
|
|
A1CE Lecture 2: the error, or anything that you're not, not doing correctly.
|
|
|
|
892
|
|
02:14:45.820 --> 02:14:55.290
|
|
A1CE Lecture 2: But I have to say, in some situations, it may have some error.
|
|
|
|
893
|
|
02:14:55.970 --> 02:15:04.900
|
|
A1CE Lecture 2: in the script, and this is the total score, and it's… I say that… it said that I don't get any point, which is…
|
|
|
|
894
|
|
02:15:05.070 --> 02:15:06.020
|
|
A1CE Lecture 2: Yes?
|
|
|
|
895
|
|
02:15:06.310 --> 02:15:17.150
|
|
A1CE Lecture 2: I still not do anything, so I cannot get any scores correct. But you can look at what you are missing by click Submission Report, right? And…
|
|
|
|
896
|
|
02:15:17.200 --> 02:15:30.319
|
|
A1CE Lecture 2: it will tell you a little bit about what you have, what you're missing, right? But I have to say, it's not every time that sometimes submission report is not
|
|
|
|
897
|
|
02:15:30.920 --> 02:15:35.700
|
|
A1CE Lecture 2: is not useful at all. But… and you… you can…
|
|
|
|
898
|
|
02:15:35.970 --> 02:15:41.439
|
|
A1CE Lecture 2: you can have a look, and you can submit again, right? But if sometime
|
|
|
|
899
|
|
02:15:42.100 --> 02:15:49.499
|
|
A1CE Lecture 2: You… you… you are sure that you do everything correctly, but still not marked as complete?
|
|
|
|
900
|
|
02:15:50.880 --> 02:15:51.980
|
|
A1CE Lecture 2: You may just…
|
|
|
|
901
|
|
02:15:52.170 --> 02:16:00.220
|
|
A1CE Lecture 2: in the lab, and maybe the next day, you try to do it again. Maybe there's some bug, some problem in some lab.
|
|
|
|
902
|
|
02:16:00.810 --> 02:16:09.289
|
|
A1CE Lecture 2: That it may cost. But as, my experience for this semester, all the lab for this course.
|
|
|
|
903
|
|
02:16:10.100 --> 02:16:16.509
|
|
A1CE Lecture 2: you should be okay, because the lab that I have been report with problem.
|
|
|
|
904
|
|
02:16:16.890 --> 02:16:36.740
|
|
A1CE Lecture 2: it's not for this course, right? So, it should be okay. So, this is how you do the lab, and when you finish the lab, you can click end, right? You don't have to wait until the time reach zero, but everything, if you do everything completely, you get all the score, you can click end lab.
|
|
|
|
905
|
|
02:16:36.760 --> 02:16:40.530
|
|
A1CE Lecture 2: Right? But if you start the lab again.
|
|
|
|
906
|
|
02:16:40.870 --> 02:16:48.229
|
|
A1CE Lecture 2: The score that the system will maintain is the latest attempt.
|
|
|
|
907
|
|
02:16:48.340 --> 02:17:03.280
|
|
A1CE Lecture 2: Right? So, make sure that the letter attempt is more than or equal to 80%, right? So, if… because if you do it again, and you get less than 80,
|
|
|
|
908
|
|
02:17:03.459 --> 02:17:14.409
|
|
A1CE Lecture 2: it will only record. If you get 70, it will record 70, and it will not get… you will not get full score, for this… for this assignment, right?
|
|
|
|
909
|
|
02:17:15.250 --> 02:17:16.090
|
|
A1CE Lecture 2: Okay.
|
|
|
|
910
|
|
02:17:17.790 --> 02:17:29.219
|
|
A1CE Lecture 2: I think that's, that's all, for the lab for today, but, I also have, I think I also,
|
|
|
|
911
|
|
02:17:29.389 --> 02:17:36.979
|
|
A1CE Lecture 2: You will have be… have to be invited, to join another cause, right? You will have…
|
|
|
|
912
|
|
02:17:37.110 --> 02:17:51.460
|
|
A1CE Lecture 2: two cores, right? AWS Academy, Cloud Architect, and AWS Academy Learner Lab, right? For Learner Lab, it's quite similar, right? When you launch, AWS Academy Learner Lab.
|
|
|
|
913
|
|
02:17:51.990 --> 02:17:56.300
|
|
A1CE Lecture 2: It also will take you, to the lab environment.
|
|
|
|
914
|
|
02:17:58.360 --> 02:18:00.399
|
|
A1CE Lecture 2: So I terminate, that's alright.
|
|
|
|
915
|
|
02:18:00.580 --> 02:18:03.490
|
|
A1CE Lecture 2: closed, this lab, right?
|
|
|
|
916
|
|
02:18:03.990 --> 02:18:09.170
|
|
A1CE Lecture 2: And… So… Okay…
|
|
|
|
917
|
|
02:18:20.120 --> 02:18:26.229
|
|
A1CE Lecture 2: I go to learn the lab, right? Fall in a lap.
|
|
|
|
918
|
|
02:18:26.600 --> 02:18:36.890
|
|
A1CE Lecture 2: Right? You can experiment, right? This is a sandbox, the closest to the sandbox environment, and everyone
|
|
|
|
919
|
|
02:18:37.170 --> 02:18:40.529
|
|
A1CE Lecture 2: You will get 50 US dollar.
|
|
|
|
920
|
|
02:18:40.680 --> 02:18:43.430
|
|
A1CE Lecture 2: credit, right? You can use all of this
|
|
|
|
921
|
|
02:18:43.670 --> 02:18:55.679
|
|
A1CE Lecture 2: without any credit card at all, you can use this. And for what you can use is also specified in this document. So.
|
|
|
|
922
|
|
02:18:55.920 --> 02:19:10.530
|
|
A1CE Lecture 2: You can use, Learner Lab, right? But you can only create resource in US East 1 or US West 2. Only this two regions is available in the lab, and
|
|
|
|
923
|
|
02:19:10.930 --> 02:19:21.680
|
|
A1CE Lecture 2: service that you can use is not everything. For 50 US dollars, you can use this following service. And some service, you may…
|
|
|
|
924
|
|
02:19:21.990 --> 02:19:29.130
|
|
A1CE Lecture 2: have some restriction, right? For example, for VM EC2,
|
|
|
|
925
|
|
02:19:30.219 --> 02:19:39.229
|
|
A1CE Lecture 2: You can use Amazon Linux, or use Microsoft Windows, but other OS than this, you may not be able to use.
|
|
|
|
926
|
|
02:19:39.350 --> 02:19:55.020
|
|
A1CE Lecture 2: And instant type, you can use, nano, instant type, micro, small, medium, and large. And not extra large, not extra large, not extra, extra large, right? So, you just only limit.
|
|
|
|
927
|
|
02:19:55.130 --> 02:19:58.740
|
|
A1CE Lecture 2: To specific size of instant, right?
|
|
|
|
928
|
|
02:19:58.940 --> 02:19:59.910
|
|
A1CE Lecture 2: And…
|
|
|
|
929
|
|
02:20:00.600 --> 02:20:12.700
|
|
A1CE Lecture 2: So, you have to check, because, it provides you the sandbox that you can test anything that you want to learn, but…
|
|
|
|
930
|
|
02:20:12.910 --> 02:20:20.529
|
|
A1CE Lecture 2: it will not, support everything, right, that you want, right? So, if you want everything.
|
|
|
|
931
|
|
02:20:20.790 --> 02:20:25.159
|
|
A1CE Lecture 2: I may suggest you to use AWS Free Tier, but…
|
|
|
|
932
|
|
02:20:25.300 --> 02:20:31.679
|
|
A1CE Lecture 2: Free tier, you still have to, work to add the credit card information.
|
|
|
|
933
|
|
02:20:31.980 --> 02:20:36.319
|
|
A1CE Lecture 2: So, at the beginning, if you're still not
|
|
|
|
934
|
|
02:20:36.550 --> 02:20:44.610
|
|
A1CE Lecture 2: Because if you, open AWS account and validate your credit card information,
|
|
|
|
935
|
|
02:20:44.900 --> 02:21:01.829
|
|
A1CE Lecture 2: It's… it's okay, but, you may accidentally, forget something, and if… if you are unlucky, the service that you test is expensive service, and that is gonna cost you… but…
|
|
|
|
936
|
|
02:21:02.040 --> 02:21:05.630
|
|
A1CE Lecture 2: If it costs you too much, we have…
|
|
|
|
937
|
|
02:21:05.870 --> 02:21:17.209
|
|
A1CE Lecture 2: one time that we can contact open ticket to AWS Helix, and say that you, made something, some mistake, and can you reimburse?
|
|
|
|
938
|
|
02:21:17.580 --> 02:21:26.920
|
|
A1CE Lecture 2: the… the… the usage, okay? Reimburse what, what database chart, I think you can.
|
|
|
|
939
|
|
02:21:27.860 --> 02:21:28.760
|
|
A1CE Lecture 2: One time.
|
|
|
|
940
|
|
02:21:29.120 --> 02:21:42.199
|
|
A1CE Lecture 2: Right? They allow… because I have been done that before, so I know that we allow to make a mistake one time, and it's re… AWS will reimburse, the expense for us.
|
|
|
|
941
|
|
02:21:42.500 --> 02:21:51.079
|
|
A1CE Lecture 2: But you, you can use database free tier. But, for, this, I think you can,
|
|
|
|
942
|
|
02:21:51.180 --> 02:21:55.439
|
|
A1CE Lecture 2: experiment and try to do.
|
|
|
|
943
|
|
02:21:56.080 --> 02:22:00.739
|
|
A1CE Lecture 2: And also, I think the… one of the assignments, is…
|
|
|
|
944
|
|
02:22:00.910 --> 02:22:04.880
|
|
A1CE Lecture 2: Oh, I… I will ask you to deploy any service.
|
|
|
|
945
|
|
02:22:05.170 --> 02:22:16.069
|
|
A1CE Lecture 2: in AWS environment, so I will ask you to do, do, to think about that assignment and using Learner Lab. So, make sure that you check
|
|
|
|
946
|
|
02:22:16.330 --> 02:22:26.650
|
|
A1CE Lecture 2: the service that support in Learning Lab, and… Okay, if you use awe, of 50 US dollar.
|
|
|
|
947
|
|
02:22:27.040 --> 02:22:28.970
|
|
A1CE Lecture 2: And you're still not complete.
|
|
|
|
948
|
|
02:22:29.130 --> 02:22:41.739
|
|
A1CE Lecture 2: the task, or you're not complete the project yet, I can add you to another course, right? So you will have one more, one more learner lab for you to use, right? So just contact me,
|
|
|
|
949
|
|
02:22:42.030 --> 02:22:44.050
|
|
A1CE Lecture 2: I will provide that to you, but…
|
|
|
|
950
|
|
02:22:44.180 --> 02:22:48.300
|
|
A1CE Lecture 2: Try to do this in a learner lab first, right?
|
|
|
|
951
|
|
02:22:48.870 --> 02:22:50.790
|
|
A1CE Lecture 2: Oh.
|
|
|
|
952
|
|
02:22:51.090 --> 02:22:57.230
|
|
A1CE Lecture 2: Okay, I think that's all but one information, because next week,
|
|
|
|
953
|
|
02:22:58.650 --> 02:23:05.209
|
|
A1CE Lecture 2: I think I'm not available for… in the Tuesday morning, so…
|
|
|
|
954
|
|
02:23:05.610 --> 02:23:21.509
|
|
A1CE Lecture 2: I will record. I make the video, right, for next week lecture, and I will set up the time, right, likely to be the whole Fridays, that you, if you want to have discussion, it can be,
|
|
|
|
955
|
|
02:23:22.740 --> 02:23:32.089
|
|
A1CE Lecture 2: mark the time, and I can be here in CMKL on Fridays, or… We… we can have,
|
|
|
|
956
|
|
02:23:32.240 --> 02:23:42.939
|
|
A1CE Lecture 2: online meeting, if you want. So, for next week, it's gonna be, video. I will upload video in the Canvas, before Tuesday morning.
|
|
|
|
957
|
|
02:23:43.310 --> 02:23:58.530
|
|
A1CE Lecture 2: And I will set up the time that if you have any questions, anything that you want to discuss, I think it's gonna be on Fridays, for the holidays, because I available the holidays.
|
|
|
|
958
|
|
02:23:58.530 --> 02:24:07.910
|
|
A1CE Lecture 2: So, if you want to discuss or anything, you can contact me via the canvas, and we can set up the meeting time on Fridays.
|
|
|
|
959
|
|
02:24:08.300 --> 02:24:16.349
|
|
A1CE Lecture 2: Okay, any… any questions? Sorry that I'm a little bit later than,
|
|
|
|
960
|
|
02:24:16.660 --> 02:24:21.559
|
|
A1CE Lecture 2: 24 past 11. Any questions before we, finish the class?
|
|
|
|
961
|
|
02:24:34.310 --> 02:24:36.750
|
|
A1CE Lecture 2: Okay, it… oops.
|
|
|
|
962
|
|
02:24:38.830 --> 02:24:50.019
|
|
A1CE Lecture 2: Okay, if there's no question, so thank you very much for today, and, next… next week, we'll be recording video on Tuesday, and we said… we can set up meet…
|
|
|
|
963
|
|
02:24:50.240 --> 02:24:54.159
|
|
A1CE Lecture 2: discussion or meeting on Friday, okay? Thank you very much.
|
|
|