1
00:00:06,760 --> 00:00:08,880
- So now that we've
talked a little bit about

2
00:00:08,880 --> 00:00:10,833
the definition of AWS,

3
00:00:11,820 --> 00:00:15,540
we've covered the shared
responsibility model,

4
00:00:15,540 --> 00:00:20,377
now let's talk about the
fundamental required atomic unit

5
00:00:21,270 --> 00:00:24,970
of AWS, the AWS Account.

6
00:00:24,970 --> 00:00:28,720
And you can think of this
as a sort of container

7
00:00:28,720 --> 00:00:30,513
for your account resources.

8
00:00:31,880 --> 00:00:35,760
Every resource that you provision in AWS

9
00:00:35,760 --> 00:00:40,760
has to be associated with
one and only one AWS Account.

10
00:00:42,220 --> 00:00:46,220
Now that does not stop
you from sharing resources

11
00:00:46,220 --> 00:00:47,820
where there are features to do so

12
00:00:47,820 --> 00:00:51,730
where you can do cross account
activity and permissions,

13
00:00:51,730 --> 00:00:55,120
but each resource has to be associated

14
00:00:55,120 --> 00:00:57,283
with one and only one account.

15
00:00:58,920 --> 00:01:02,320
And the AWS Account has
a number of different

16
00:01:03,500 --> 00:01:08,453
useful operations, such as
being a unit of organization.

17
00:01:10,020 --> 00:01:13,700
It is becoming more and more
standard for companies today

18
00:01:13,700 --> 00:01:15,560
to have more than one account

19
00:01:15,560 --> 00:01:17,730
to be able to isolate their workloads

20
00:01:17,730 --> 00:01:20,110
from each other properly.

21
00:01:20,110 --> 00:01:25,110
And using a service
like AWS Organizations,

22
00:01:25,140 --> 00:01:30,140
you can actually create an
inverted tree of accounts

23
00:01:30,230 --> 00:01:32,443
and treat them like organizational units.

24
00:01:34,530 --> 00:01:36,580
It is also a unit of billing.

25
00:01:36,580 --> 00:01:40,460
There is a monthly bill that is associated

26
00:01:40,460 --> 00:01:42,233
with every AWS Account.

27
00:01:43,190 --> 00:01:46,170
There are features for
consolidating the bills,

28
00:01:46,170 --> 00:01:50,133
but it is an atomic unit of
where the bills come from.

29
00:01:52,300 --> 00:01:55,333
And it is a unit for access.

30
00:01:56,290 --> 00:01:58,700
You can define permissions

31
00:01:58,700 --> 00:02:01,970
within the individual AWS Accounts

32
00:02:01,970 --> 00:02:05,820
to help isolate your workloads
and the various operations

33
00:02:05,820 --> 00:02:07,793
from each other in that way as well.

34
00:02:09,130 --> 00:02:14,130
Each AWS Account is going to
require a single root user.

35
00:02:15,770 --> 00:02:18,680
And this is going to show up in the form

36
00:02:18,680 --> 00:02:20,853
of a unique email address.

37
00:02:21,790 --> 00:02:26,430
A root user cannot have
the same email address

38
00:02:26,430 --> 00:02:29,173
for more than one AWS Account.

39
00:02:31,350 --> 00:02:34,700
An account also has to
have billing information.

40
00:02:34,700 --> 00:02:39,700
So either it is part of a
consolidated billing structure

41
00:02:39,930 --> 00:02:42,860
or it has actual payment information

42
00:02:42,860 --> 00:02:44,223
within the account itself.

43
00:02:46,650 --> 00:02:49,850
And finally, you need contact information,

44
00:02:49,850 --> 00:02:53,920
a name, an address, a
verifiable phone number

45
00:02:53,920 --> 00:02:56,463
for your account to be fully provisioned.

46
00:02:59,670 --> 00:03:01,310
Now, within each of these accounts,

47
00:03:01,310 --> 00:03:02,933
we're going to have resources.

48
00:03:03,780 --> 00:03:07,130
And each resource in AWS

49
00:03:07,130 --> 00:03:10,280
has a globally unique identifier

50
00:03:10,280 --> 00:03:14,503
called an Amazon Resource Name or ARN.

51
00:03:15,530 --> 00:03:19,200
And this ARN is represented as a string

52
00:03:19,200 --> 00:03:21,993
with different fields separated by colons.

53
00:03:22,850 --> 00:03:26,767
The first field is simply ARN, arn:.

54
00:03:27,870 --> 00:03:30,870
The second field is
going to be a partition.

55
00:03:30,870 --> 00:03:35,490
Most AWS customers are going
to see this as just AWS,

56
00:03:35,490 --> 00:03:37,720
but as you can see here,
there are a couple of choices,

57
00:03:37,720 --> 00:03:39,910
aws-cn for China

58
00:03:39,910 --> 00:03:42,543
or us-gov for GovCloud.

59
00:03:44,570 --> 00:03:46,830
The next field is the name of the service.

60
00:03:46,830 --> 00:03:48,610
And I've listed a couple of examples here,

61
00:03:48,610 --> 00:03:52,050
but all the services that
have a service API endpoint

62
00:03:52,050 --> 00:03:55,023
are going to be represented
in this section.

63
00:03:57,140 --> 00:04:02,140
The next field is optional
and it represents the region.

64
00:04:02,150 --> 00:04:04,370
We're gonna talk about
the global infrastructure

65
00:04:04,370 --> 00:04:06,210
coming up in just a
little bit so don't worry.

66
00:04:06,210 --> 00:04:10,370
You're gonna get a full definition
of how all of this works.

67
00:04:10,370 --> 00:04:13,110
But if a service has a
region associated with it,

68
00:04:13,110 --> 00:04:14,900
it will show up here, and if it doesn't,

69
00:04:14,900 --> 00:04:16,550
it will simply be an empty field.

70
00:04:18,810 --> 00:04:20,860
Next, we have the account ID

71
00:04:20,860 --> 00:04:22,440
and this is going to be represented

72
00:04:22,440 --> 00:04:25,993
by a 12-digit string of numbers.

73
00:04:27,030 --> 00:04:30,480
And finally, we have the resource ID.

74
00:04:30,480 --> 00:04:34,220
And this will be the
identifier within the service

75
00:04:34,220 --> 00:04:36,570
and the region and the account

76
00:04:36,570 --> 00:04:39,790
that uniquely identifies the resource.

77
00:04:39,790 --> 00:04:42,210
And there are a lot of
different options here.

78
00:04:42,210 --> 00:04:46,130
IAM users, EC2 instances, EBS volumes,

79
00:04:46,130 --> 00:04:49,430
S3 buckets, objects within the buckets.

80
00:04:49,430 --> 00:04:52,623
And we're gonna talk about all
of these during our course.
