Please enable JavaScript.

Coggle requires JavaScript to display documents.

M7 IAM-Arch (SAML slide -(MT: S: SSO, M stands for Microsfot AD) (SAML…

- - - - assertion - iUsed to dentify user
      - Include attribute such as session duration
      - XML document
- - - - https://www.youtube.com/watch?v=nuPjljOVZmU
- - - - se the Organizations APIs to automate the creation and management of new AWS accounts. The Organizations
      - APIs can create new accounts programmatically, and to add them to a group.
      - The policies attached to the group are automatically applied to the new account.
      - For example, you can automate the creation of sandbox accounts for developers and grant entities in those accounts access only to the necessary AWS servic
  - - - et up a single payment method for all the AWS accounts
      - can see a combined view of charges incurred by all your accounts.
      - To take advantage of pricing benefits from aggregated usage such as volume discounts for Amazon EC2 and Amazon S3.
  - - - An SCP can be applied to one or more OUs or individual accounts.
      - Service Control Policies (SCPs) to set permission guardrails with the fine-grained controls used in AWS Identity and Access Management (IAM) policiy
      - all IAM principals (users and roles) adhere to SCP.
- - - - 2.1)The APP request temp credential using AssumeRoleAPIwith webIdentity, passing the cogintio token
  - - - when to use ?
        
        Granting access to Amazon services for federated partner
        
        authenticated either through Cognito UserPools or Social logins (e.g; Gmail, Facebook, etc.) to have access to AWS Services under your AWS account.
        
        Credentials broker that takes valid tokean return AWS credential
        
        Authenticated and guest access to AWS for your application
        
        Temporary limited-privilege access for tools and developer
        
        Access to AWS resources for your federated identities
      - No charges. User Pool got charges. refer to pricing
    - - Granting access to an application.
        
        AWS Cognito UserPools is used to authenticate users for your applications.
        
        You just need to integrate AWS Cognito UserPools, which will manage user sign-up, sign-in, password policies.
      - Provides OpenID Connect and
        OAuth2.0 standard tokens
- - - - Organizations MASTER account: It provisions and manages
        MEMBER accounts under AWS Organizations Service.
      - CORE accounts in an Organizational Unit: It provides essential functions that are common to all the accounts under the Organizations, such as Log Archive, Security management, and Shared Services like the directory service.
      - TEAM/GROUP accounts in Organizational Units: These are designated for individual business units at the granularity of team or group level. For example, a set of Team accounts may consist of the team’s Shared Services account, Development account, Pre-Production account, and Production account.
      - DEVELOPER accounts: These are “sandboxes” for individual’s learning and experimentation.
      - Connectivity: This is set up with default networking patterns among the accounts and with external data centers
  - - - nsuring that any child account added under the master were built according to a pre-defined template
      - Once added, previously defined Stack Sets automatically roll out to the new environments, providing a baseline set of resources for each additional account.
      - User Access
        
        User Access: Providing least-privilege, individual user access to your AWS accounts is an essential, foundational component to AWS account management. The AWS Landing Zone solution provides customers two options to store their users and groups.
        us
      - Notifications ???The AWS Landing Zone solution configures Amazon CloudWatch alarms and events to send a notification on root account login, console sign-in failures, API authentication failures, and the following changes within an account: security groups, network ACLs, Amazon VPC gateways, peering connections, ClassicLink, Amazon Elastic Compute Cloud (Amazon EC2) instance state, large Amazon EC2 instance state, AWS CloudTrail, AWS Identity and Access Management (IAM) policies, and AWS Config rule compliance stat
- - - - With an IdP, you manage your user identities outside of AWS (such as Login with Amazon, Google, and Facebook) and give thes EXTERNAL user identities permissions to use AWS resources in your account.
- - - - The Governing account is used to provide an extra layer of security that can be managed centrally.