{"componentChunkName":"component---src-templates-blog-js","path":"/ctf/aws-formation/tp8-advanced-iam","result":{"data":{"markdownRemark":{"html":"<h2>1. Web Identity Federation</h2>\n<h3>definition</h3>\n<p>Web Identity Federation let you give your user access to AWS resouce after successfull authentification (like Gogle Facebook or Amazon).\nthey receive an <em>authentifiaction code</em> fro mthe web ID provider, which they can trade for <strong>temporary AWS security credentials</strong>.</p>\n<h3>amazon cognito</h3>\n<p>provides Web Identity Federation with folowing features :</p>\n<ul>\n<li>Sign-up and sign-in to your apps</li>\n<li>Access for guest users</li>\n<li>Acts as an <strong>Identiy Brokers</strong> between your app and web id providers (you do not need to write your own code to do this)</li>\n<li>synchronize user data for multiple devices</li>\n<li>recommended for all mobile applications AWS services</li>\n</ul>\n<p>It is the recommended approach for web identity federation using social media accounts like facebook</p>\n<p><img src=\"/assets/TP8-AdvancedIAM-image-20200723032104521.png\" alt=\"TP8-AdvancedIAM-image-20200723032104521\"></p>\n<p>Cognito can log you to different applciations</p>\n<h2>2. Cognito User Pools</h2>\n<h3>definitions -  <strong>User Pools</strong></h3>\n<p>They are users directories used to manage sign-up and sign-in for mobile and web applications</p>\n<p> Users can sign-in directly to the user pool, or indirectly provider (Facebook, Amazon, Google).\nActs as an <strong>Identiy Brokers</strong> between your AWS app and web id providers. If successful authetification it generates a JSON web tokens (<strong>JWT</strong>)</p>\n<h3>definitions -  <strong>Identity  Pools</strong></h3>\n<p>Identity  Pools enable to create unique identifies for your users and authentificate them with identity providers</p>\n<h3>example</h3>\n<p><img src=\"/assets/TP8-AdvancedIAM-image-20200723032910524.png\" alt=\"TP8-AdvancedIAM-image-20200723032910524\"></p>\n<h3>push synchronisation</h3>\n<p>Cognito tracks the association between user identity and various devices.</p>\n<p>Cognito uses <em>Push Synchronization</em> to send a silent push notification of user data updates to multiples devie types associated with a user ID.</p>\n<h2>3. Cognito Lab</h2>\n<p>you can create group of users</p>\n<h3>steps</h3>\n<ol>\n<li>Create an user Pools</li>\n<li>Add an app client</li>\n<li>Enable Identify providers</li>\n<li>Defines sign in and out URL : Callabck URL (redirection of the user after successfull authentification)</li>\n<li>OAuth 2.0 (JWT tokens) : Open Standard Authentification Framework </li>\n<li>Attach an Amazon Cognito Domain Name</li>\n<li>Customize Cognito (optional)</li>\n</ol>\n<p>`login?response<em>type=token&#x26;client</em>id=1343243&#x26;redirect_url=<a href=\"https://example.com\">https://example.com</a></p>\n<h2>4. Inline Policies vs Managed Policies vs Custom Policies</h2>\n<p><strong>IAM</strong> : Identity Access Managements, is used to define user access permissions within AWS</p>\n<p>There are 3 differents types of IAM policies available :</p>\n<ol>\n<li>\n<p>Managed Policies : AWS-managed default policiies</p>\n<ul>\n<li>for common use ceses based on job function</li>\n<li>you can not change the permissions defined in the AWS management Policies</li>\n</ul>\n</li>\n<li>\n<p>Customer Managed Policies : Managed by you</p>\n<ul>\n<li>is a standalone policy that create and administer inside you own AWS account</li>\n<li>you can attach this policy to multiple user, but only within your users</li>\n</ul>\n</li>\n<li>\n<p>Inline Policies  : Managed by you and ambedded in a single user, group, or role.</p>\n<ul>\n<li>it is an IAM policy which is actually embedded in a <strong>single</strong> user = strict relationship between the entity and the policy</li>\n</ul>\n</li>\n</ol>\n<p>In most cases AWS recommends using <strong>Manages Policies</strong> over Inline Policies</p>\n<h2>5. STS AssumeRoleWithWebIdentity API</h2>\n<p>AssumeRoleWithWebIdentity is an API provided by STS (<strong>Security Token Service</strong>)</p>\n<p>Retuns temp security credentials for users\nAllow to authentificate users from a web identity provider to access AWS resource\nOne the user has authentificated, the application makes the assume-role-with-web-identity </p>\n<p>If you are on a mobile -> use Cognito,\nIf not you can use AssumeRoleWithWebIdentity</p>\n<p><img src=\"/assets/TP8-AdvancedIAM-image-20200723034948990.png\" alt=\"TP8-AdvancedIAM-image-20200723034948990\"></p>\n<p>AssumeRoleUser  with ARN (ARN identifiers which can be used refer to the temp credential) + Credentials (temporaty)</p>","frontmatter":{"date":"July 31, 2020","path":"ctf/aws-formation/tp8-advanced-iam","title":"TP8 - Advanced IAM","tags":["cloud","ec2","aws"],"categorie":"ctf","thumbnail":"/assets/alex-machado-80sv993luki-unsplash.jpg"},"fields":{"readingTime":{"text":"3 min read"}}},"file":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAAAAMEBf/EABUBAQEAAAAAAAAAAAAAAAAAAAED/9oADAMBAAIQAxAAAAGFz11jKaIn/8QAGhAAAgMBAQAAAAAAAAAAAAAAAAECERMSMf/aAAgBAQABBQLm3gxwaJTxe1i8/8QAGBEAAgMAAAAAAAAAAAAAAAAAAAECElH/2gAIAQMBAT8BUdKn/8QAFhEBAQEAAAAAAAAAAAAAAAAAABEB/9oACAECAQE/Abqv/8QAGhAAAQUBAAAAAAAAAAAAAAAAAQACEBESIv/aAAgBAQAGPwJckOjObVBtR//EABwQAQACAgMBAAAAAAAAAAAAAAEAETFBIWFxkf/aAAgBAQABPyEVB9ih2jUSxfkFQDkWX4Ju5grU/9oADAMBAAIAAwAAABDjD//EABYRAQEBAAAAAAAAAAAAAAAAAAEAIf/aAAgBAwEBPxAA1M//xAAWEQEBAQAAAAAAAAAAAAAAAAABIRD/2gAIAQIBAT8QWYTP/8QAGhABAQEAAwEAAAAAAAAAAAAAAREAIUFxwf/aAAgBAQABPxAYkFlcFzRnCFCH3zCCggiKI5gk6hL1lpwEhs0zEABv/9k=","aspectRatio":1.4970059880239521,"src":"/static/11cdcb302d032fa2db3a46428a8f74c9/a7715/alex-machado-80sv993luki-unsplash.jpg","srcSet":"/static/11cdcb302d032fa2db3a46428a8f74c9/8f7df/alex-machado-80sv993luki-unsplash.jpg 250w,\n/static/11cdcb302d032fa2db3a46428a8f74c9/0f3a1/alex-machado-80sv993luki-unsplash.jpg 500w,\n/static/11cdcb302d032fa2db3a46428a8f74c9/a7715/alex-machado-80sv993luki-unsplash.jpg 1000w,\n/static/11cdcb302d032fa2db3a46428a8f74c9/37d86/alex-machado-80sv993luki-unsplash.jpg 1500w,\n/static/11cdcb302d032fa2db3a46428a8f74c9/a41d1/alex-machado-80sv993luki-unsplash.jpg 2000w,\n/static/11cdcb302d032fa2db3a46428a8f74c9/6a059/alex-machado-80sv993luki-unsplash.jpg 6000w","sizes":"(max-width: 1000px) 100vw, 1000px"}}}},"pageContext":{"slug":"ctf/aws-formation/tp8-advanced-iam","featuredImage":"alex-machado-80sv993luki-unsplash.jpg"}}}