inflearn logo

Understanding and Security of AWS Cloud IAM Used in Practice

You can learn about IAM, the foundation of AWS Zero Trust, from the most basic elements to the most detailed specifics. Through this, you can learn which parts may actually be vulnerable and where you need to pay more attention.

(4.9) 35 reviews

443 learners

Level Basic

Course period Unlimited

AWS
AWS
iam
iam
devsecops
devsecops
Terraform
Terraform
devops
devops
AWS
AWS
iam
iam
devsecops
devsecops
Terraform
Terraform
devops
devops

Reviews from Early Learners

Reviews from Early Learners

4.9

5.0

김경민

30% enrolled

This lecture is content-focused.

5.0

lim.hj

100% enrolled

It's a good class.

5.0

udin

6% enrolled

While learning and operating AWS, I think the most difficult area is IAM. I quickly understood it because it was explained in detail and easily. To be honest, I don't think there is anyone who handles IAM with this level of quality. I really recommend it.

What you will gain after the course

  • Service Control Policies (SCPs)

  • Configuring policies to prevent credential leaks

  • Understanding IMDS and Configuring a Secure Environment

  • Understanding IRSA and Configuring a Secure Environment

  • Overall Understanding of AWS IAM and Policy Deep Dive

  • Attack Practice and Defense Due to Vulnerable Policies

  • RolesAnywhere Strategy and Practical Use

The basics of security: Getting familiar with AWS IAM!

The Basics of AWS Cloud: IAM
Where and how should you start?

  • “Where and how should I start with IAM?”
  • “I understand that IMDS/IRSA is working, but what should I configure and what needs to be improved?”
  • “Is there a way to securely integrate with on-premises environments without using long-term credentials?” …

In this course, we will explore the most fundamental aspects of AWS (Amazon Web Services) through IAM.

  • ✅ You will understand the basics of AWS IAM and learn how to configure not only basic policies but also secure policies tailored to your environment.
  • ✅ You will also understand how IMDS (Instance MetaData Service), IRSA (IAM Roles for Service Accounts), and Pod Identity work, and learn how to securely configure your environment.
  • ✅ Additionally, we will examine vulnerabilities caused by the structural issues of managed clusters and learn how to prevent them.
  • ✅ Learn about RolesAnywhere and how to use it in practice.

Recommended for the following people:

🙍‍♀️

Those who are handling AWS security but don't know where or how to start approaching it

🙍‍♂️

Those who have a rough idea of what IMDS and IRSA are, but don't know how they work or how to handle their security.

🙋‍♀️

Those who want to establish security policies but are unsure of what is possible or impossible with IAM

🙋‍♂️

Those who want to build Zero Trust in an AWS environment


What you will learn 📚

Take your understanding of IAM and practical service security to the next level!

  • 1️⃣ You will gain a fundamental understanding of IAM and examine policy components that are easy to miss, enabling you to configure optimal policies.
  • 2️⃣ You will understand the security methods used in the massive service that is AWS and learn how to utilize them.
  • 3️⃣ You will think about security in other areas beyond just IAM and examine what factors are considered when configuring security in practical work environments.

1) IAM Overview and Features

  1. Users/Groups/Roles/Policies
  2. SCPs, JSON policy elements
  3. IAM Condition Keys and Their Applications

2) IMDS (Instance MetaData Service)

  1. Understanding IMDS and how it works
  2. IMDSv1 vs IMDSv2
  3. Proxy Server Vulnerabilities and Countermeasures
  4. Transition to IMDSv2
  5. Configuring a Secure IMDS Environment

3) IRSA (IAM Roles for Service Accounts)

  1. Understanding IRSA and How It Works
  2. Conditions under which IRSA can become vulnerable
  3. Configuring a secure IRSA environment

4) BIG IAM CHALLENGE

  1. Analysis of vulnerable policies
  2. Attempting an attack by bypassing vulnerable policies

5) Structural Vulnerabilities of Managed Clusters

  1. Explanation of structural vulnerabilities in managed clusters
  2. Examining how the vulnerability works

6) IAM Global Condition Key Bug

  1. Bug occurring when accessing S3 from the console
  2. Bug occurring when accessing CloudWatch Logs from the console

7) aws-iam-gitops project

  1. GitLab CI/CD <-> Using AWS Keyless Roles
  2. DevSecOps (Shift-Left) practice through CI
  3. Explanation and understanding of GitOps

8) RolesAnywhere

  1. Introduction to RolesAnywhere and how it works
  2. Certificate Issuance Conditions and PCA vs ECA
  3. Usage strategies, precautions, and hands-on practice

Nice to meet you, I'm Cloud Engineer Kangmin Chun 🙂

Hello, I am currently working as a cloud engineer at KakaoBank. Standing on the shoulders of the giant that is AWS, I strive to build Zero Trust security tailored to specific business characteristics. By learning and experiencing knowledge across various fields, I am building a flexible yet highly robust security environment. I believe that by accumulating this knowledge, one can further enhance their own strengths.

I hope that through this lecture, many of you will be able to deepen your understanding of IAM and learn the essentials for security.


Q&A 💬

Q. Is it possible to learn AWS IAM through such a short course?

While it is important to try out various services related to IAM, what is even more crucial is the policy, which serves as the foundation for them all. Once you understand policies and commonly used services (such as IMDS/IRSA), you will be able to configure and understand other IAM-related features without much difficulty. In other words, you can consider this to be a highly condensed overview that covers a vast amount of content relative to the time spent.

Q. How does studying IAM help?

If you are using AWS, IAM is at the foundation of everything. In fact, you can become much more secure with just simple policies, and by learning how to navigate permissions, you can grant them much more efficiently. Furthermore, by experiencing the various security-related features implemented by a giant like AWS, you can gain ideas for the various applications or architectures you will build.

Q. I'm not in cloud security, but can I still take this course?

This course is not targeted solely at the specific role of cloud security. I believe IAM is the most fundamental element when using AWS. Therefore, through this course, I believe you will be able to cultivate not only your own unique skills but also the ability to perform more secure development and operations.

💾 Notes before taking the course

  • You can take this course as long as you have an AWS account and organization setup (optional), and an environment where Python and Terraform can run.
  • As prerequisite knowledge, you should know how to enter commands through a terminal. Additionally, it is helpful to have experience using IAM-related features (creating users, policies, roles, etc.). Other than that, a passion for learning IAM is more than enough.
  • We provide all lecture presentation materials and the source code used in class.

Recommended for
these people

Who is this course right for?

  • Those who want to use IMDS safely

  • Those who want to understand AWS IAM

  • Those who want to use IRSA safely

  • Those who want to lay the foundation for configuring a Zero Trust environment

  • Those who do not want to use long-term credentials

Need to know before starting?

  • Python

  • Terraform

  • AWS

Hello
This is rex

1,571

Learners

116

Reviews

45

Answers

4.9

Rating

4

Courses

I am currently working as a Cloud Engineer (SRE) at KakaoBank. My role involves designing and providing service architectures, as well as creating, providing, or building various tools required by the organization.

Contact: 7424069@gmail.com

More

Curriculum

All

66 lectures ∙ (7hr 45min)

Course Materials:

Lecture resources
Published: 
Last updated: 

Reviews

All

35 reviews

4.9

35 reviews

  • youngyoonchoi9469님의 프로필 이미지
    youngyoonchoi9469

    Reviews 6

    Average Rating 5.0

    5

    30% enrolled

    • gyhong0230님의 프로필 이미지
      gyhong0230

      Reviews 1

      Average Rating 5.0

      5

      100% enrolled

      • jhun80jeong2035님의 프로필 이미지
        jhun80jeong2035

        Reviews 16

        Average Rating 5.0

        5

        30% enrolled

        • scy님의 프로필 이미지
          scy

          Reviews 2

          Average Rating 4.5

          5

          100% enrolled

          • jsc3171님의 프로필 이미지
            jsc3171

            Reviews 8

            Average Rating 5.0

            5

            100% enrolled

            rex's other courses

            Check out other courses by the instructor!

            Similar courses

            Explore other courses in the same field!

            $68.20