Learn what AWS Identity and Access Management (IAM) technologies are available for you to manage users and their access to your AWS environment. We present a high level discussion of the benefits and functionality IAM provides to control secure access to your AWS environment. We discuss how you can manage users and their permissions when using IAM, how roles makes it simpler for you delegate access, and how to use Multi-Factor Authentication (MFA) to require additional proof of identity.

4. © 2012 Amazon.com, Inc. and its affiliates. All rights reserved. May not be copied, modified or distributed in whole or in part without the express consent of Amazon.com, Inc.

5. File Sharing: C:homemydata.log
Who Name Permission Level
Patrick Read
What Anna Owner
Actions?
Which
Resources?

6. Amazon Amazon Amazon Amazon
Amazon AWS IAM Amazon
RDS SES CloudWatch SNS
Route 53 DynamoDB
Amazon
CloudFront
Amazon Amazon
AWS
EC2 S3
Storage
Gateway
AWS
CloudFormation
Amazon Amazon Amazon Amazon Amazon Amazon Amazon
Elastic ElastiCache CloudSearch VPC SWF Elastic SQS
MapReduce Beanstalk
© 2012 Amazon.com, Inc. and its affiliates. All rights reserved. May not be copied, modified or distributed in whole or in part without the express consent of Amazon.com, Inc.

7. © 2012 Amazon.com, Inc. and its affiliates. All rights reserved. May not be copied, modified or distributed in whole or in part without the express consent of Amazon.com, Inc.

8. AMIs Elastic IPs Placement Groups Users
Spot Instances Templates
Distributions Buckets
Volumes Clusters
Roles
Messages Instances Files Groups
Tables
Snapshots Topics Load Balancers
Security Groups Workflows Autoscaling Groups
Domains Applications
Queues Network Interfaces
© 2012 Amazon.com, Inc. and its affiliates. All rights reserved. May not be copied, modified or distributed in whole or in part without the express consent of Amazon.com, Inc.

9. Over 1 Trillion Resources Over 650K Requests/Sec
Hundreds of Thousands “Many” Servers
of Customers
© 2012 Amazon.com, Inc. and its affiliates. All rights reserved. May not be copied, modified or distributed in whole or in part without the express consent of Amazon.com, Inc.

10. AWS
© 2012 Amazon.com, Inc. and its affiliates. All rights reserved. May not be copied, modified or distributed in whole or in part without the express consent of Amazon.com, Inc.

11. © 2012 Amazon.com, Inc. and its affiliates. All rights reserved. May not be copied, modified or distributed in whole or in part without the express consent of Amazon.com, Inc.

13. *While Joe and his story are fictional, you may find many of his challenges quite real

21. Joe Raises $1.5M Series A Financing Round!

24. Joe
Dev/Ops Development Sales/Marketing Finance/Accounting
Administrator Full access to: Read-only to Account Activity
Access: Amazon S3, Amazon Amazon S3 and Usage
DynamoDB
Control all AWS +
Reports only
resources, The ability to start
including (but not stop)
managing users Amazon EC2
instances

25. Joe
Sales/Mark Finance/Ac
Dev/Ops Development
eting counting
Graeme Nate Anders Joan
Greg Cicilie Erin
Kevin Brian
Jeff

26. © 2012 Amazon.com, Inc. and its affiliates. All rights reserved. May not be copied, modified or distributed in whole or in part without the express consent of Amazon.com, Inc.

27. © 2012 Amazon.com, Inc. and its affiliates. All rights reserved. May not be copied, modified or distributed in whole or in part without the express consent of Amazon.com, Inc.

28. © 2012 Amazon.com, Inc. and its affiliates. All rights reserved. May not be copied, modified or distributed in whole or in part without the express consent of Amazon.com, Inc.

50. Joe
Sales/Mark Finance/Ac
Dev/Ops Development
eting counting
Graeme Nate Anders Joan
Greg Cicilie Erin
Kevin Brian
Jeff

52. #!/bin/bash
export AWS_IAM_HOME=~/IAMCli-1.5.0
export AWS_CREDENTIAL_FILE=~/IAMCli-1.5.0/aws-credential.template
export JAVA_HOME=/System/Library/Java/JavaVirtualMachines/1.6.0.jdk/Contents/Home
# Create users, and add them to the "TestSubjects" group
iam-usercreate -u RedShirt1 -g TestSubjects
iam-usercreate -u RedShirt2 -g TestSubjects
iam-usercreate -u RedShirt3 -g TestSubjects
…
iam-usercreate -u RedShirt24 -g TestSubjects
iam-usercreate -u RedShirt25 -g TestSubjects

53. http://aws.amazon.com/documentation/iam/

55. Amazon Amazon
Dynamo S3
DB
AWS Cloud

56. ? ? Auto
Scaling
Auto
Scaling ? ?
Amazon Amazon
Dynamo S3
DB
AWS Cloud

58. Auto Auto
Scaling Scaling
Amazon Amazon
GeneticAnalysis Dynamo S3
AWS IAM
Server: RW DB
access to files, AWS Cloud
rows

66. MARTHA!

68. Capacity
The Martha effect
Urbanchickens.org
Time

75. AWS MFA supports any OATH TOTP
compatible application (RFC 6238)

86. Joe’s Chicken Genetics
Intranet Portal
Joe

98. Enterprise
Multi-Factor Authentication
Startup/ Federation & SSO
SMB Password Strength Policy
AWS Marketplace Control
Joe Users, Groups, Permissions
Management UI, CLI, API
Basic Roles for EC2
No additional charge
© 2012 Amazon.com, Inc. and its affiliates. All rights reserved. May not be copied, modified or distributed in whole or in part without the express consent of Amazon.com, Inc.

100. Code Session Time
SEC101 A Guided Tour of AWS Identity and Access Management Wednesday 11/28 2.05pm
SEC302 Delegating Access to Your AWS Environment Wednesday 11/28 3.25pm
SEC303 TOP 10 IAM Best Practices Thursday 11/29 3pm

101. We are sincerely eager to
hear your feedback on this
presentation and on re:Invent.
Please fill out an evaluation
form when you have a
chance.