- [Stephane] Welcome to the first deep dive
on an iterator service.
The first one is called IAM.
So IAM stands for identity and access management.
It is a global service because in IAM,
we are going to create our users and assign them to group.
So we've already used IAM without knowing,
when we created an account, we created a root accounts,
and has been created by default.
This is the root user of our accounts.
And the only things you should use it for is
to set up your account as we'll do it right now.
But then you shouldn't use that account anymore,
or even share it.
What you should be doing instead, is create users.
So you will create users in IAM,
and one user represents one person within your organization.
And the users can be grouped together if it makes sense.
So let's take an example we have an organization
with six people.
You have Alice, Bob, Charles, David, Edward
and Fred so all these people are in your organization.
Now Alice, Bob, and Charles they work together.
They're all developers.
So we're going to create a group called
the group developers who regrouping Alice,
Bob and Charles.
And it turns out that David and Edward also work together.
So we're going to create an operations group.
Now we have two groups within IAM.
Now groups can only contain users, not other groups.
So this is something very important to understand.
Groups only contain users.
Now, some users don't have to belong to a group.
For example, Fred right here is alone,
he does not correspond to any group.
That is not best practice.
But it is something you can do in AWS.
And also, a user can belong to multiple groups.
That means that for example, if you know that Charles
and David worked together,
and they're part of your audit team,
you can create a third group with Charles and David.
And as you can see, now, in this example,
Charles and David are part of two different groups.
So this is the possible configurations for IAM.
So why do we create users and why do we create groups?
Well, because we want to allow them to use our AWS accounts
and to allow them to do so,
we have to give them permissions.
So users or groups can be assigned
what's called a JSON document.
I'll show you right now what it means called a policy,
an IAM policy.
So it looks just like this.
So you don't have to be a programmer.
This is not programming.
This is just describing in, I think plain English,
what a user is allowed to do or what a group
and all the users within that group are allowed to do.
So in this example, we can see that we allow people
to use the EC2 to service and do describe on it,
to use the elastic load balancing service
and to describe on it and to use CloudWatch.
Now we'll see what EC2 elastic load balancing
and CloudWatch mean, but through this JSON document
that looks just like this.
We are allowing our users to use some services in AWS.
So these policies will help us define permissions
of our users.
And so in AWS, you don't allow everyone to do everything
that would be catastrophic,
because a new user could basically launch so many services
and they will cost you a lot of money
or would be valid for security.
So in AWS, you apply a principle called
the least privilege principle.
So you don't give more permissions than a user needs.
Okay, so if a user just needs access to three services,
just create a permission for that user.
So now we have seen an overview IAM.
Let's go in the next lecture
to practice creating users and groups.