Okay.
Hello clubbers and welcome to this lecture and this lecture we're going to look at identity access management
and we're going to look at how we can use roles so roles that enable us to interact with the AWOL platform
without having to pass ROTC to instances access key I.D. and secret access keys and roles aren't just
used for easy to use for basically every other AWOL service as well.
We're going to have a look at that in the eight IBS consoles so this is a lab and you will need to log
in to the database console.
Okay so here I am in the adobe us console.
And if I just go over to services I'll be able to create a role under identity access management which
is under security identity and compliance.
And we have actually already created a role before.
If you click on roles you'll be able to see some roles in here and you should see it cross region replication
role.
So we created that role automatically when we enable cross region replication for our buckets.
So let's go ahead and create a new role.
And in here it says choose the service that will be using this role.
So you can see here are a list of services that support roles.
We're obviously going to be using easy to so click on AC to go ahead and hit next.
And then it's going to ask us to attach a policy.
So I'm going to give us administrator access for this role and then we're just gonna go ahead and hit
next and then the role NAME.
I'M JUST GOING TO CALL IT admin access and that's it and I'm gonna go ahead and create my role.
So that has now created my role.
Let's go over to easy to and we can find it under compute.
I'm sure you know that by now and in here we've got our running instance.
So at the moment my this is the easy to instance from the last lab.
I'm to go over and assess H into it.
Okay.
So here I am in my easy to instance and if you just go over to your home directory if you remember if
we type in unless we can't see anything but there is a hidden directory which is the AWOL directory
so let's go ahead and delete that.
So what I'm gonna do is I'm just gonna type R.M. minus r f and then dot AWOL s and this will delete
that directory so it has now deleted it.
We go in to try and go into it you can see now that there's no such file or directory and if we type
Adobe S S3 L S we won't be able to access S3 anymore because we've just deleted all the credentials
that allowed us to do it we couldn't recreate that directory just by running Adobe US configure and
then entering in our access key and secret access key I'm not going to do that however I'm just going
to leave it and what we're gonna do now is we're gonna go and attach a role to ATC to instance some
back in the Edelweiss console I'm gonna click on my easy to instance and I'm gonna go over to actions
and I'm going to go to my instant settings and in here you can see attached replace I am wrong so let's
go ahead and click on that and we're gonna give this role we're gonna attach our admin access role and
I'm gonna go ahead and hit apply and then I'm gonna go ahead and hit closed.
So that has now attached the role you should be able to see it down here somewhere.
So here we go.
I am role administrator access if you click on that you'll be able to see the role itself and you'll
be able to go in and see the actual policy you can click on the Jason and the policy is actually quite
interesting because basically it's saying effect allow action wildcards so allow any action on any resource
and that is administrator access they'll give you full access to the AWOL platform let's go back over
to our SS H terminal some back in my SS H terminal and now if I type W S S three Ls and we'll be able
to see our S3 Buckets so there we go we now have for administrator access to our adult US environment
but likewise if we try and go to the AWB s hidden directory it's not there and there's no credentials
being stored on this easy to instance now so if this easy to instance got hacked hackers would still
be able to run the ATO US command line they'd still be able to do stuff but they wouldn't be able to
take our access key idea or secret access case so this would be their only port of entry into our AWB
account.
So let's go ahead and delete that easy to instance.
So I'm just gonna go back to the dashboard back too easy too and then I'm gonna go into my running instance
and I'm going to terminate that instance and there we go that's terminated.
So what are my exam tips will rolls are far more secure than storing your access key I.D. and secret
access key on individual easy two instances.
Rolls are much easier to manage.
So imagine if you did lose your access key I.D. and secret access key and you had a fleet of a thousand
easy two instances that that key was installed on.
You'd have to go in and update the access key idea and secret access key on all those 1000 easy two
instances.
As if you just had a role where you could actually just go in and change the role and that change would
take effect immediately.
Roles can be assigned to easy to instances after it's created both using the console as well as the
command line.
Roles are universal so you can use them in any region.
So we created that role in IAM we were able to use it in the London Region.
Likewise we'd be able to use it in the Northern Virginia region or anywhere else in the world.
So that is it for this lecture guys in the next lecture we're going to look at bash scripting and this
is awful lot of fun.
I love bash scripting with AWP so if you got the time please join me in the next lecture.
Thank you.