- [Instructor] Today I'm going to show you
how to use permission sets with customer managed policies.
First, I'll show you
how permission sets work and a use case,
and then I'm going to demo how
to implement the use case with CMPs.
Instead of federating and managing permissions separately
for each AWS account, in Identity Center,
you manage access to accounts
by creating and assigning permission sets.
Permission sets are role templates
that define which policies to include
in the role that Identity Center will create
in each account in your AWS organization.
This allows you to centrally implement IM permission
across multiple AWS accounts at one time,
without needing to configure each of your accounts manually.
Up until recently, permission sets
could only contain AWS managed policies
and to customize them, you needed to attach inline policies.
Now, you can attach customer managed policies
to permission sets.
This allows you to tailor the policies
in each of the AWS accounts
to reference specific resources, for example.
Let's see, challenges without CMPs.
For a security operator, you have access
to the security operations account
where you use tooling to centralize
the Amazon CloudWatch log groups
from every account in your organization.
However, if the logs from any of the accounts are missing,
you need to access the log groups in each individual account
to troubleshoot and inspect them.
To accomplish this, you need to define
the log group ARN in each account.
As you can see, each ARN will be different,
and this is what the solution will look like,
using inline policies on the permission set.
You are going to add an inline policy
to your permission sets,
listing the log group ARN of each of your accounts.
Now, if you add more accounts to your AWS organizations,
you need to manually add the log group ARN
of that new account into your policy
or create an automation to add that ARN in the policy.
Now, let's see how to simplify this deployment with CMPs.
In the demo, first, we're going to create CMPs
with consistent names in each of the target accounts.
Then, this is key.
Each CMP needs to have the same name.
We're going to create permissions sets
that reference the CMP,
then assign users to the permission sets
in the accounts where you have the CMP.
Finally, we're going to test your assignments.
Let's get started.
In the management account, we can see two member accounts.
Let's start creating CMPs in the member accounts.
In the member account, choose IAM,
Policies, and then Create Policy.
Choose the JSON tab and post your policy.
Add your account ID to the policy and click Next.
(no audio)
Add tags if you like, and click Next.
Add the name of your policy.
Remember, this name has to be the same
across all your member accounts
and repeat this process in all member accounts.
Now, let's create the permission set and reference the CMP.
In the Identity Center dashboard on the management account,
choose Permission Sets, then choose Create Permission Set.
Here, we're gonna choose custom Permission Set.
In the option Customer Managed Policies,
click on Attached Policies
and write the name of the policy we just created
on the member account, then click Next.
Now, enter the name of your permission set.
Click Next, review and create your permission set.
You will be redirected to the permission sets page,
where you can now see your permission set.
Now you can assign user access.
Choose AWS accounts
and select the member accounts you want to assign access to.
Click on Assign users or groups.
(no audio)
Notice that we are assigning access
to two accounts at the same time.
Now, select the users or groups and choose Next.
Choose the permission that you
allowed CloudWatch operations and review and submit.
(no audio)
Identity Center is now configuring your accounts.
Identity Center successfully applied
the permissions to your account.
We created CMP's in the target account,
created a permission set with that CMP,
and assigned access to our user.
Let's now test the assignment.
(no audio)
As you can see, the security operator now has access
to CloudWatch log groups in two accounts.
CMP greatly simplifies this deployment.
With CMP support, you can create a policy
in each of the accounts
and refer to it in permission sets.
You no longer have to maintain a long list
of resource ARN in inline policies.