AWS Organizations
Allows to manage multiple AWS account.
Single payment method for AWS accounts within organization.
Price Benefit
Use by creating different OUs(Organization Units)
Use cloudtrails
Enabling cloudtrails on all account will send log to central S3 account.
Send cloudwatch log to central logging account.
Security Control Policies(SCP)
IAM policies Used to restrict OUs and Accounts to User and roles.
They will not applied to management account.
Tag policies
Standardize tags across resources in an AWS organization.
Event Bridge can be used to detect non-compliant tags.
Permission Boundaries
Use to set the boundaries for users and roles.(not groups)
Limit the permission of IAM users and roles by setting boundaries over it.
Can be used with SCP.
Policies Evaluation Logics
Explicit Deny will be considered as Deny even though some of its permission are allow after the Deny.
Identity Center
One login for
- All AWS accounts in AWS Organization.
- Business Cloud Application and
- EC2 windows instance
Fine-grain permissions and assignments
Multi-account permissions
Permission Sets - a collection of one or more IAM policies assigned to AWS users and group to defines AWS access
Application Assignments
SSO access to many SAML 2.0 business applications.
Provides required URL, Certificates and metadata.
Attribute Based Access Control
Fine Grained User permission based on user attributes stored in Identity center store.
Define permission once then modify access by changing the attributes.
Note
Event Bridge normally requires resource based access policy when setting up permissions for targets like lambda.
Kinesis streams are configured with identity based policies associated with the user service or the service making the request.
Can't grant on it → grant as something (a role).
AWS Directory Services
AWS Managed Microsoft AD
Create own active directory on AWS.
Establish trust connection with on premise AD
AD Connector
Gateway(proxy) to redirect to on premise AD.
Users are managed on the on premise AD.
Simple AD
AD compatible managed directory on AWS.
Can't be joined with on premise AD.
AWS Control Tower
Used to setup and govern compliant multi account AWS env.
Uses AWS Organizations to create accounts.
Guradrails
On going governance for AWS Control Tower Environment.
Preventive Guardrails - uses AWS SCP (eg. to restrict the access)
Detective Guardrails - uses AWS Config (eg. identify untagged resources)