|
|
| (3 intermediate revisions by the same user not shown) |
| Line 1: |
Line 1: |
| − | # AWS Accounts and Organizations including Service Control Policies (SCPs)
| + | <!-- moved to a /training subpage --> |
| − | ## SCPs "deny" will override any higher up "allow" permissions. So even though an allow permission will cascade down through all Org Units, any explicit deny will also cascade and override allow.
| |
| − | ## You can choose your own strategy. By default an Organization will have the '''FullAWSAccess''' SCP attached to it and every OU and account. This is the 'Deny List Strategy' because you must override the 'default' allow full access with deny rules. On the other hand, you can remove (delete) this SCP and then you would have an 'Allow List Strategy' because you would need to specifically list each service you want to allow in the Organizations, OUs and Accounts.
| |
| − | ## AWS Control Tower allows you to setup and govern multi-account environments.
| |
| − | # Identity Management and Permissions including RBAC, ABAC and permissions boundaries
| |
| − | ## Roles are '''assumed''' by users, applications and services.
| |
| − | ## Policies are JSON and may be either Identity based, or Resource based.
| |
| − | ## Authentication methods: password + optional MFA token; Access Key + Secret Access Key; X-509 Certificate
| |
| − | ## AWS Security Token Service (STS) sts:AssumeRole returns temporary security credentials.
| |
| − | ## Multi-Factor Authentication
| |
| − | ;Something you '''know'''
| |
| − | ;Something you ''' have'''
| |
| − | ;Something you '''are'''
| |
| − | A Trust Policy is also an example of a resource-based policy.
| |
| − | A Permissions Policy is an identity-based policy.
| |
| − | # AWS Directory Services and Federation including Identity Federation, AWS SSO, and Cognito
| |
| − | # Advanced Amazon VPC including a routing deep dive and multi-account VPC configurations
| |
| − | # Hybrid Connectivity including S2S VPN, Direct Connect, and AWS Transit Gateway
| |
| − | # Compute, Auto Scaling, and Load Balancing including ALB, NLB, EC2, and NAT
| |
| − | # AWS Storage Services including EBS, EFS, and Amazon S3
| |
| − | # DNS, Caching, and Performance Optimization including Route 53, CloudFront, and AWS Global Accelerator
| |
| − | # AWS Database Services including Amazon RDS, Aurora, ElastiCache and DynamoDB
| |
| − | # Serverless Applications including AWS Lambda, EventBridge, SQS, SNS, and API Gateway
| |
| − | # Docker Containers and PaaS including Amazon ECS, Fargate, and Elastic Beanstalk
| |
| − | # Deployment and Management including AWS CodeCommit, CodePipeline, Service Catalog, Systems Manager and more
| |
| − | # Migration and Transfer Service including AWS DMS, SMS, DataSync, and Snowball
| |
| − | # Analytics Services including Amazon Athena, AWS Glue, RedShift, EMR, and Kinesis
| |
| − | # Monitoring, Logging and Auditing including CloudWatch, CloudTrail and AWS X-Ray
| |
| − | # Defense in Depth including how to build a secure application with ACM, KMS, Config, Inspector and WAF/Shield
| |
| − | # Cost Management including how AWS services are priced, consolidated billing, and AWS Budgets
| |
