Getting started with identity on AWS
summary
Recommendation: adopt AWS SSO as the single entry point, link an external IdP or the native directory, and assign role-oriented permission sets across accounts; enforce guardrails with Service Control Policies and deploy repeated resources with StackSets. Use tag policies and Resource Groups to find, group, and restrict Project-level resources at scale. Run IAM Access Analyzer (it uses automatic reasoning, analyzes thousands of policies in seconds across S3 KMS SQS Lambda and more and is free) and consider AWS Control Tower to provision a secure multi-account landing zone.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 0:53Identity Model
- 3:19Can Access
- 6:16Resource Management
- 7:11Tag Policies
- 8:06Access Control
- 8:36AWS SSO
- 10:27Application Access
- 11:21AWS Accounts
- 12:31Scaling through account creation
- 13:52AWS Organizations
- 14:21Organizational Units
- 18:04AWS Control Tower
- 19:05Recap
- 19:47Shrink Permissions
- 20:06Access Analyzer
- 21:03Summary
- 22:06References
- 22:22Resources
related talks
25mGetting started with AWS Identity Services
28mIdentity Services on AWS
01h 02mWhy IAM is the new perimeter, and how to govern it
57mA first-principles approach: AWS Identity and Access Management (IAM)
31mIAM and why it is important in Cloud environments
01h 00mAWS Identity Workshop
44mAchieve your identity, security, and compliance goals on
57mBest practices for cloud governance at scale