Inflearn brand logo image
Inflearn brand logo image
Inflearn brand logo image
BEST
Security & Network

/

Computer Security

Understanding and Securing AWS Cloud IAM in Practice

You can learn about IAM, the foundation of AWS Zero Trust, from the basics to the details. This will help you understand what parts are actually vulnerable and where you need to pay more attention.

(4.9) 28 reviews

414 learners

  • rex
보안
클라우드
iam
AWS
devsecops
Terraform
devops

Reviews from Early Learners

What you will learn!

  • Service Control Policies (SCPs)

  • Policy for preventing credential leakage

  • Understanding IMDS and Configuring a Safe Environment

  • Understanding IRSA and Configuring a Secure Environment

  • Deep Dive into AWS IAM Overview and Policies

  • Attack and defense practices due to vulnerable policies

  • RolesAnywhere Strategy and Practical Use

Security Basics, Get Familiar with AWS IAM!

AWS Cloud Basics: IAM
Where and how should I start?

  • “Where and how should I start with IAM?”
  • “I know IMDS/IRSA works, but what do I need to configure and improve?”
  • “Can we securely integrate with on-prem without using long-term credentials?” …

In this lecture, you will learn about the most basic parts of AWS (Amazon Web Services) through IAM.

  • ✅ Understand the basics of AWS IAM and configure not only basic policies but also secure policies that fit your environment.
  • ✅ Understand how Instance MetaData Service (IMDS), IAM Roles for Service Accounts (IRSA), and Pod Identity work and learn how to securely configure your environment.
  • ✅ We will also look at vulnerabilities caused by structural problems in managed clusters and learn how to prevent them.
  • ✅ Learn about RolesAnywhere and how to use it in practice.

I recommend this to these people.

🙍‍♀️

I have AWS security but I don't know where to start or how to access it.

🙍‍♂️

I know roughly what IMDS and IRSA are, but I don't know how they work and how to handle security.

🙋‍♀️

If you want to set up a security policy but don't know what is possible or impossible with IAM

🙋‍♂️

Anyone who wants to build zero trust in an AWS environment


What you'll learn 📚

Take your understanding of IAM and service practice security to the next level!

  • 1️⃣ You will gain a fundamental understanding of IAM, learn about policy components that are easily overlooked, and be able to configure optimal policies.
  • 2️⃣ You will learn how to understand and utilize the security methods used in the huge service called AWS.
  • 3️⃣ We will think about security in other areas as well as IAM, and look at what is considered and how security is configured in practice.

1) IAM Overview and Functions

  1. User/Group/Role/Policy
  2. SCPs, JSON policy elements
  3. IAM Condition Keys and Utilization

2) IMDS (Instance MetaData Service)

  1. Understanding IMDS and How It Works
  2. IMDSv1 vs IMDSv2
  3. Proxy Server Vulnerabilities and Responses
  4. IMDSv2 Transition
  5. Configuring a Secure IMDS Environment

3) IRSA (IAM Roles for Service Accounts)

  1. Understanding IRSA and How It Works
  2. Conditions under which IRSA may become vulnerable
  3. Configuring a Secure IRSA Environment

4) BIG IAM CHALLENGE

  1. Analysis of vulnerable policies
  2. Attack by bypassing vulnerable policies

5) Structural vulnerabilities of managed clusters

  1. Describing structural vulnerabilities in managed clusters
  2. Examining how the vulnerability works

6) IAM global condition key bug

  1. Bug when accessing S3 from console
  2. Bug when accessing CloudWatch Logs from the console

7) aws-iam-gitops project

  1. Using GitLab CI/CD <-> AWS Keyless Roles
  2. DevSecOps (Shift-Left) Practice via CI
  3. Description and understanding of gitops

8) RolesAnywhere

  1. Introduction to RolesAnywhere and how it works
  2. Certificate Issuance Conditions and PCA vs ECA
  3. Usage strategies, precautions and practice

Nice to meet you, I am cloud engineer Cheon Kang-min 🙂

Hello, I am currently working as a cloud engineer at Kakao Bank. I am working on building zero-trust security that takes into account the characteristics of the business by standing on the shoulders of the giant called AWS. I am learning and experiencing knowledge from various fields to build a flexible but very strong security environment. I believe that I can further enhance my strengths by accumulating this knowledge.

I hope that through this lecture, many people will be able to increase their understanding of IAM and learn what is necessary for security.


Q&A 💬

Q. Can I learn AWS IAM in such a short lecture?

It is important to try out various services related to IAM, but more importantly, the policies that form the basis of them. Once you understand the policies and the services (IMDS/IRSA) that are frequently used, you will be able to configure and understand other functions related to IAM without much difficulty. In other words, you can think of it as containing a lot of content compared to the time.

Q. How can studying IAM help me?

If you are using AWS, IAM is at the foundation of everything. In fact, you can be much more secure with just a simple policy, and you can grant permissions much more efficiently if you learn how to find permissions. Also, by experiencing various security-related functions implemented by the giant called AWS, you can get ideas for various applications or architectures that you can implement.

Q. I don't do cloud security, can I still take the course?

This lecture is not only targeting the job of cloud security. If you use AWS, I think the most basic thing is IAM. Therefore, I think that through this lecture, you will be able to develop your own abilities as well as safer development/operation abilities.

💾 Things to note before taking the class

  • You can take the course if you have set up an AWS account and organization (optional) and have an environment where Python and Terraform can work .
  • As a prerequisite, you should know how to input commands through the terminal . In addition, it would be good to have experience using IAM-related functions (creating users, creating policies, creating roles, etc.). In addition, if you have a passion for learning IAM, that is sufficient.
  • We provide all lecture presentation materials and source code used in class.

Recommended for
these people

Who is this course right for?

  • If you want to use IMDS safely

  • If you want to understand AWS IAM

  • If you want to use IRSA safely

  • Those who want to establish an environment configuration foundation for zero trust

  • Those who do not want to use long-term credentials

Need to know before starting?

  • Python

  • Terraform

  • AWS

Hello
This is

2,346

Learners

105

Reviews

40

Answers

4.9

Rating

5

Courses

현재 카카오뱅크에서 클라우드 엔지니어(SRE)로 근무하고 있습니다. 서비스를 위한 아키텍처를 설계/제공하고, 조직에서 필요한 다양한 도구들을 만들고 제공하거나 구축하는 등의 일을 하고 있습니다.

 

문의: 7424069@gmail.com

Curriculum

All

66 lectures ∙ (7hr 45min)

Course Materials:

Lecture resources
Published: 
Last updated: 

Reviews

All

28 reviews

4.9

28 reviews

  • gyw8526님의 프로필 이미지
    gyw8526

    Reviews 3

    Average Rating 5.0

    5

    30% enrolled

    • 이철영님의 프로필 이미지
      이철영

      Reviews 4

      Average Rating 5.0

      5

      30% enrolled

      • 홍성민님의 프로필 이미지
        홍성민

        Reviews 2

        Average Rating 4.5

        5

        30% enrolled

        • 김경민님의 프로필 이미지
          김경민

          Reviews 3

          Average Rating 5.0

          5

          30% enrolled

          내용에 충실한 강의입니다.

          • ygjeon님의 프로필 이미지
            ygjeon

            Reviews 8

            Average Rating 4.8

            Edited

            3

            62% enrolled

            $68.20

            rex's other courses

            Check out other courses by the instructor!

            Similar courses

            Explore other courses in the same field!