1) IAM Introduction: Users, Groups, Policies – AWS Certified Solutions Architect Associate Course SAA-C02 – IAM & AWS CLI– Welcome to the first deep dive on AWS Service, The first one is called IAM.

• So IAM Stands for identity access management.
• It is a global service because
• in IAM we are going to create our users and assign them to group.
• So we’ve already used IAM without knowing,
• when we created an account, we created a root accounts,
• and has been created by default.
• This is the root user of our accounts.
• and the only things you should use it for is
• to set up your account as we’ll do it right now.
• But then you shouldn’t use that account anymore.
• or even share it.
• what you should be doing instead, is create users.
• So you will create users in IAM.
• and one user represents one person within your organization.
• and the users can be grouped together if it makes sense.

So let’s take an example we have an organization with six people.

• You have Alice, Bob, Charles, David, Edward and Fred.
• So all these people are in your organization.
• Now Alice, Bob and Charles they work together.
• They’re all developers.
• So we’re going to create a group called
• the group developers who regrouping Alice, Bob And Charles.

• And it turns out that David and Edward also work together.
• So we’re going to create an operations group.
• now we have two groups within IAM.
• Now groups can only contain users, not other groups.
• So this is something very important to understand.
• Groups only contain users.
• Now, some users don’t have to belong to a group.
• For example, Fred right here is alone,
• he does not correspond to any group.
• That is not best practice.
• But it is something you can do in AWS.
• And also, a user can belong to multiple groups.
• That means that for example, if you know that Charles and David worked together,
• and they’re part of your audit team,
• you can create a third group with Charles and David.
• And as you can see, now, in this example,
• Charles and David are part of two different groups.

So this is the possible configurations for IAM.

• So why do we create users and why do we create groups?
• Well, because we want to allow them to use our AWS Accounts.
• and to allow them to do so,
• we have to give them permissions.
• So users or groups can be assigned what’s called a JSON document.
• I’ll show you right now what it means called a policy.
• an IAM Policy.
• So it looks just like this.

• So you dont have to be a programmer.
• This is not programming.
• This is just describing in, I think plain English,
• what a user is allowed to do or what a group and all the user within that group are allowed to do.
• So in this example, we can see that we allow people
• to use the EC2 service and do describe on it,
• to use the elastic load balancing service.
• and to describe on it.
• and to use CloudWatch.
• Now we’ll see what EC2, elastic load balancing and CloudWatch mean, but through this JSON document, that looks just like this.
• we are allowing our users to use some services in AWS.
• so these policies will help us define permissions of our users.
• So in AWS, you dont allow everyone to do everything.
• that would be catastrophic,
• because a new user could basically launch so many services.
• and they will cost you alot of money.
• or would be valid for security.
• So in AWS, you apply a principle called the least privilege principle.
• So you dont give more permissions than a user needs.
• Okay, so if a user just needs access to three services,
• just create a permission for that user.
• So now we have seen an overview IAM.
• Lets go in the next lecture to practice creating users and groups.