- Alright, so let's talk about the AWS Identity
and Access Management service.
Within AWS, we need a way to authenticate and authorize
our users.
Authentication being knowing who that person is.
Authorization being what they're allowed to do.
Now, of course, just like any system we have the ability
to create users and groups of users.
We have the ability to control our password policy,
and it's recommended that we set a strong password policy
including disallowing the last certain number of passwords
that perhaps the last two or three or four passwords
should not be reused.
We also have the ability to enable
Multifactor Authentication.
So, just in case we might not be familiar with that,
Multifactor Authentication could be described as
"something you have," "something you know," and
"something you are."
Now, the "something you are" would be biometrics,
like fingerprints, iris scan, and of course those
aren't available here within the AWS Identity
and Access Management service, but the other two are.
"Something you know," would be like your user name
and your password.
"Something you have" would be a Multifactor Authentication
or an MFA device, such as a key fob or a virtual MFA
device on your cell phone.
So, MFA, or Multifactor Authentication is fulfilling
at least two of those.
So, "something you know," the user name and password
combined with "something you have" would fulfill the
Multifactor Authentication.
It just adds that extra layer of security to your account
and it's highly recommended and considered best practice
that we enable that and use that for all members who
especially need to log into the console, or in other cases
that we'll talk about later when you're doing special
types of things like accessing your production account.
Now, it's really important to note that what we're talking
about here, creating users and groups,
authenticating and authorizing,
this is meant for authenticating
and authorizing against the Amazon Web Services API.
When you think about realms of authentication,
like the areas into which we need to authenticate our users,
that would be one, being the AWS API,
which is what the Identity and Access Management
service is for.
And then, of course, we have our operating system.
If we install applications on that operating system
or databases, then they would have their own realm
of authentication and their own set of users.
So it's important to know that what we're talking about
here within the IM service, the Identity and Access
Management, that this is specifically for authenticating
against the AWS API.
It is not to be used for OS level authentication,
or application or database level authentication.
Except in the case of Amazon DynamoDB, and we'll
talk about that later.
So, again, the AWS Identity and Access Management service
is for authenticating and authorizing users and
groups of users against the Amazon Web Services API.