This book and its accompanying online resources are designed to be a complete preparation tool for your AWS SAP-C02 Exam.

The book is written in a way that you can apply everything you’ve learned here even after your certification. The online practice resources that come with this book (Figure 1.1) are designed to improve your test-taking skills. They are loaded with practice questions, interactive flashcards, and exam tips to help you work on your exam readiness from now till your test day.

Before You Proceed

To learn how to access these resources, head over to Chapter 21, Accessing the Online Practice Resources, at the end of the book.

Figure 1.1: Dashboard interface of the online practice resources

Here are some tips on how to make the most out of this book so that you can clear your certification and retain your knowledge beyond your exam:

1. Read each section...

AWS Identity and Access Management (IAM) is used to define and control who can access which resources in an AWS environment. IAM concepts and how they provide security controls are a key part of the exam. Here are some key concepts:

Every new AWS account comes with a root user that has full access to all AWS services and all the resources in the account. As a best practice, it is recommended to do the following:

• Immediately protect that root user with multi-factor authentication (MFA).
• Secure the root user credentials and only use them if you need to perform specific service and account management tasks that only the root user can perform.

Note

See https://packt.link/VKoZg for more details on tasks that only the root user can perform.

IAM users

An IAM user is an entity designed to be associated with a single individual or application. It is used to allow access to AWS resources either through the AWS Management...

In this section, you will investigate two different approaches organizations can take to control access, either based on a principal’s role or based on specific properties, also known as attributes, characterizing a principal.

Role-Based Access Control (RBAC)

This is the traditional access control approach where the permissions defining the actions that a principal (user or role) can perform are based on the function that the person has in their job. You typically define different policies for the roles you need in your organization and then assign these policies to IAM identities (users, user groups, or roles). Note that AWS already includes some managed policies for job functions.

Since granting the least privilege is a best practice, you should restrict the permissions that you grant to the various job functions to the strict minimum each of them needs to perform its job. Typically, you do that by explicitly listing the AWS resources each...

You are now going to investigate access delegation. Access delegation is essentially used for the following reasons:

• Providing an entity temporary access to resources that they do not have access to with their current privileges. This could be one of the following:
  • A user that needs temporarily elevated privileges to perform a specific task
  • An application or AWS service that requires specific privileges
• Providing an entity access to resources located in another AWS account.

Now, start by examining these cases.

Temporary Access Delegation

Take for instance, the first use case where you need to provide trusted users, applications, or AWS services with temporary security credentials so that they can access your AWS resources. As the name implies, the security credentials that will be provided are temporary, which has the following benefits:

• The access provided is limited to a short period of time, typically ranging from a few...

It is only natural for organizations to want to reuse their existing IdPs to give their workforce, customers, or partners access to AWS without having to create and manage a separate set of identities on AWS. This avoids multiplying long-lived security credentials unnecessarily and, as such, limits the security risks. You can leverage either AWS Single Sign-On (AWS SSO) or AWS IAM to enable user federation depending on the use case.

AWS SSO is well suited for cases where you want to establish user federation across multiple AWS accounts and leverage your existing corporate or a third-party IdP. You can then assign permissions to your users based on their group membership in your IdP’s directory and control access by modifying users and groups on your IdP. You can also implement ABAC, whether via the user information synchronized with your IdP via System for Cross-domain Identity Management (SCIM) or by passing user attributes in Security Assertion...

AWS Directory Service offers several choices for organizations to deploy existing applications on AWS that rely on Microsoft AD or Lightweight Directory Access Protocol (LDAP). This is the native AWS service to use when you need a directory to manage users, groups, devices, and access.

AWS Directory Service proposes different options to use Microsoft AD with AWS services, as follows:

• Simple AD: A low-scale and low-cost directory with basic Microsoft AD compatibility
• AD Connector: A proxy service to connect to a remote Microsoft AD on-premises
• Managed Microsoft AD: A Microsoft AD environment managed by AWS

The following sections will discuss the main differences between these three options and when to use one or the other.

Simple AD

Simple AD is a Microsoft AD-compatible directory that provides basic AD features such as managing user accounts, group memberships, and group policies, joining a (Linux or Windows) EC2 instance...

AD Connector is a scalable proxy service that forwards requests to your on-premises AD. It offers an easy way to connect compatible AWS applications—for instance, Amazon WorkSpaces, Amazon QuickSight, or Amazon EC2 for Microsoft Windows Server instances—to your existing on-premises Microsoft AD. It does not require you to synchronize your directory and does not add extra cost or complexity—there’s no need, for instance, to set up a federation infrastructure.

AD Connector supports numerous AWS applications and services such as Amazon WorkSpaces, Amazon WorkDocs, Amazon QuickSight, or Amazon Connect. It also lets you join your EC2 Windows instances to your on-premises AD domain seamlessly. Users can also leverage it to sign in to the AWS Management Console and manage AWS resources using their existing AD credentials.

AD Connector does not cache any information on AWS, which has both benefits (your users’ information is never stored...

In this first chapter, you have reviewed the core IAM concepts of AWS. You then investigated cross-account access control and user federation, which are essential elements for supporting complex organizations. Finally, you looked at the various flavors offered by AWS Directory Service. All these functionalities are core for securing access to AWS resources for complex organizations. So, do make sure these elements are crystal clear in your mind before moving on and, especially if that is not the case, have a look at the additional resources provided in the next section.

The next chapter of this book will take you through the AWS networking capabilities you need to know about to select and configure the optimal network topology for your organization.