Auto-sync: wiki-ingest 3 sources (2026-04-16)
This commit is contained in:
@@ -12,7 +12,7 @@ tags:
|
||||
date-added: 2026-04-14
|
||||
video-source: "nas:///volume2/work/Public Cloud Learning Sessions/CTP _ Topic 11_ AD Integration, and Login using AD accounts.mp4"
|
||||
audio-source: ""
|
||||
status: summarized
|
||||
status: summarized (Gemini 摘要)
|
||||
---
|
||||
|
||||
# CTP Topic 11 AD Integration, and Login using AD accounts
|
||||
@@ -21,7 +21,7 @@ status: summarized
|
||||
|
||||
**Type:** VIDEO | **Category:** 02_IAM
|
||||
|
||||
**Status:** 🟡 Awaiting Whisper transcription → Summary
|
||||
**Status:** ✅ 已完成（Gemini 摘要）
|
||||
|
||||
---
|
||||
|
||||
|
||||
@@ -1,17 +1,17 @@
|
||||
---
|
||||
title: "CTP Topic 5 - AWS Identity and Access Management (IAM)"
|
||||
title: CTP Topic 5 - AWS Identity and Access Management (IAM)
|
||||
type: cloud-learning
|
||||
source-type: video
|
||||
category: "DevOps & SRE/02_IAM"
|
||||
category: DevOps & SRE/02_IAM
|
||||
tags:
|
||||
- AWS
|
||||
- IAM
|
||||
- Security
|
||||
- CTP
|
||||
date-added: 2026-04-14
|
||||
video-source: "nas:///volume2/work/Public Cloud Learning Sessions/CTP _ Topic 5 - AWS Identity and Access Management (IAM).mp4"
|
||||
video-source: nas:///volume2/work/Public Cloud Learning Sessions/CTP _ Topic 5 - AWS Identity and Access Management (IAM).mp4
|
||||
audio-source: ""
|
||||
status: raw
|
||||
status: summarized (Gemini 摘要)
|
||||
---
|
||||
|
||||
# CTP Topic 5 - AWS Identity and Access Management (IAM)
|
||||
@@ -26,7 +26,35 @@ status: raw
|
||||
|
||||
## 摘要
|
||||
|
||||
> 待转录后由 LLM 生成
|
||||
> ## AWS Identity and Access Management (IAM) Explained
|
||||
|
||||
This session covers AWS Identity and Access Management (IAM), focusing on users, groups, roles, and policies, and how they relate to accessing AWS via the CLI and federation. The discussion emphasizes accessing landing zone accounts and determining the appropriate method.
|
||||
|
||||
Key points include:
|
||||
* IAM dashboard resources: users, groups, customer managed policies, roles, and identity providers.
|
||||
* Federated access: Users gain access to accounts via Active Directory (AD) groups, which grant specific roles.
|
||||
* `accounts.json`: This file, located in the root of every landing zone, contains a list of account numbers.
|
||||
* IAM users are primarily for service accounts; federation is the preferred method for user management.
|
||||
* User groups are less relevant due to the focus on federated user management.
|
||||
* Roles are used by services or users and tie together permissions.
|
||||
* Policies define permissions, specifying what actions are allowed or denied on resources.
|
||||
* *Roles don't enable actions; they tie together who can do something and what they can do.*
|
||||
* Policies can be AWS-managed or customer-managed.
|
||||
|
||||
Federated users log in via their organization's AD, which maps to an IAM role. Command-line access via federation requires a tool called PFSSO. *We only want to allow the access that is strictly required.* Least privilege model: Granting only the necessary permissions is crucial.
|
||||
|
||||
Configuring permissions typically involves a service accessing AWS resources, requiring a role and policy. Terraform modules can define IAM roles, including an assumed role policy and inline policy blocks. Policies should be fine-grained, limiting access to only the required resources. Inline policies are tied to a specific role, while managed policies can be reused across multiple roles.
|
||||
|
||||
Key takeaways:
|
||||
* Federation is the primary method for user access.
|
||||
* Roles and policies are central to managing permissions.
|
||||
* Least privilege is a guiding principle when defining policies.
|
||||
* Consider using inline policies for role-specific permissions and managed policies for reusable permissions.
|
||||
* When defining pterogrant modules, ensure policies are not too wide open.
|
||||
* VSM requests are required to gain account access through Federation.
|
||||
* User attributes beyond usernames are supported, including additional STS values and tags.
|
||||
* Cross-account role assumption is possible, where principles in specified accounts can assume a role.
|
||||
|
||||
|
||||
---
|
||||
|
||||
|
||||
@@ -0,0 +1,51 @@
|
||||
---
|
||||
title: CTP Topic 5 - AWS Identity and Access Management (IAM)
|
||||
type: cloud-learning
|
||||
source-type: video
|
||||
category: DevOps & SRE/02_IAM
|
||||
tags:
|
||||
- AWS
|
||||
- IAM
|
||||
- Security
|
||||
- CTP
|
||||
date-added: 2026-04-14
|
||||
video-source: nas:///volume2/work/Public Cloud Learning Sessions/CTP _ Topic 5 - AWS Identity and Access Management (IAM).mp4
|
||||
audio-source: ""
|
||||
status: raw
|
||||
---
|
||||
|
||||
# CTP Topic 5 - AWS Identity and Access Management (IAM)
|
||||
|
||||
**Source:** NAS `/volume2/work/Public Cloud Learning Sessions/CTP _ Topic 5 - AWS Identity and Access Management (IAM).mp4`
|
||||
|
||||
**Type:** VIDEO | **Category:** 02_IAM
|
||||
|
||||
**Status:** 🟡 Awaiting Whisper transcription → Summary
|
||||
|
||||
---
|
||||
|
||||
## 摘要
|
||||
|
||||
> 待转录后由 LLM 生成
|
||||
|
||||
---
|
||||
|
||||
## 关键概念
|
||||
|
||||
-
|
||||
|
||||
---
|
||||
|
||||
## 行动项
|
||||
|
||||
-
|
||||
|
||||
---
|
||||
|
||||
## 相关视频
|
||||
|
||||
> 配对视频笔记链接（生成后填入）
|
||||
|
||||
---
|
||||
|
||||
*最后更新: 2026-04-14*
|
||||
@@ -10,7 +10,7 @@ tags:
|
||||
date-added: 2026-04-14
|
||||
video-source: "nas:///volume2/work/Public Cloud Learning Sessions/Learning Sessions _ Identity Governance VSM replacement -20231128_160326-Meeting Recording (1).mp4"
|
||||
audio-source: ""
|
||||
status: raw
|
||||
status: summarized (Gemini 摘要)
|
||||
---
|
||||
|
||||
# Learning Sessions Identity Governance VSM replacement -20231128 160326-Meeting Recording (1)
|
||||
@@ -23,28 +23,10 @@ status: raw
|
||||
|
||||
---
|
||||
|
||||
## 摘要
|
||||
## Identity Governance and VSM Replacement
|
||||
|
||||
> 待转录后由 LLM 生成
|
||||
The learning session covers identity governance, focusing on the replacement of Virtual SM (VSM), a DXC tool, with identity governance (IG). The objective is to understand identity governance, its necessity, micro-focused IG, its utilization with control tower and counter-automation, the plan to replace VSM with IG, and how to use the IGA portal.
|
||||
|
||||
---
|
||||
Identity governance is a framework for managing digital identities efficiently, minimizing risk, and maintaining compliance. Key questions addressed by identity governance include: *who currently has access to our systems, who should have access, and how is the access being done?* It comprises identity management, access management, and identity auditing. Microfocus's IGA governs access through resources, providing workflows for approving and revoking access, as well as monitoring and auditing access. IG is used to provide access to both internal and external users, including contractors, with time-limited access.
|
||||
|
||||
## 关键概念
|
||||
|
||||
-
|
||||
|
||||
---
|
||||
|
||||
## 行动项
|
||||
|
||||
-
|
||||
|
||||
---
|
||||
|
||||
## 相关视频
|
||||
|
||||
> 配对视频笔记链接（生成后填入）
|
||||
|
||||
---
|
||||
|
||||
*最后更新: 2026-04-14*
|
||||
IG integrates with AWS Identity Center to provide access to resources via IAM. Groups in Active Directory represent roles, and IG governs access to these groups. A bridge is established using Azure AD domain services for authentication. IG controls Active Directory groups and workflows, while IAM connects to Azure to Cobdom domain. The plan is to replace VSM with IG for all accounts, using the same architecture as VSM, but with IG connected to Coptum domain. Changes include adding owner information to Active Directory groups and automating the account owner as the first-level approver. A POC is underway to validate the architecture and process. Gaining access involves searching for the resource in the IG portal, requesting access, and filling out a form. The request goes through an approval flow, and upon approval, access is granted automatically.
|
||||
|
||||
@@ -0,0 +1,50 @@
|
||||
---
|
||||
title: "Learning Sessions Identity Governance VSM replacement -20231128 160326-Meeting Recording (1)"
|
||||
type: cloud-learning
|
||||
source-type: video
|
||||
category: "DevOps & SRE/02_IAM"
|
||||
tags:
|
||||
- Identity-Governance
|
||||
- VSM
|
||||
- CTP
|
||||
date-added: 2026-04-14
|
||||
video-source: "nas:///volume2/work/Public Cloud Learning Sessions/Learning Sessions _ Identity Governance VSM replacement -20231128_160326-Meeting Recording (1).mp4"
|
||||
audio-source: ""
|
||||
status: raw
|
||||
---
|
||||
|
||||
# Learning Sessions Identity Governance VSM replacement -20231128 160326-Meeting Recording (1)
|
||||
|
||||
**Source:** NAS `/volume2/work/Public Cloud Learning Sessions/Learning Sessions _ Identity Governance VSM replacement -20231128_160326-Meeting Recording (1).mp4`
|
||||
|
||||
**Type:** VIDEO | **Category:** 02_IAM
|
||||
|
||||
**Status:** 🟡 Awaiting Whisper transcription → Summary
|
||||
|
||||
---
|
||||
|
||||
## 摘要
|
||||
|
||||
> 待转录后由 LLM 生成
|
||||
|
||||
---
|
||||
|
||||
## 关键概念
|
||||
|
||||
-
|
||||
|
||||
---
|
||||
|
||||
## 行动项
|
||||
|
||||
-
|
||||
|
||||
---
|
||||
|
||||
## 相关视频
|
||||
|
||||
> 配对视频笔记链接（生成后填入）
|
||||
|
||||
---
|
||||
|
||||
*最后更新: 2026-04-14*
|
||||
Reference in New Issue
Block a user