🖼️ See the drawing + lab 🏠 Course home 🌿 Branch on GitHub ✏️ View source

🖼️ आकृती आणि labThe drawing + lab पूर्ण पानावर उघडा ↗Open full page ↗

🏢 धडा 10 — लोक मोठ्या प्रमाणावर: IAM Identity Center

📍 तुम्ही इथे आहात: 12 पैकी धडा 10 · मागील: lesson-09-cross-account · पुढील: lesson-11-least-privilege

📦 या ब्रँचमध्ये काय आहे

धडे 01–09, आणि लोकांनी AWS पर्यंत कसे पोहोचावे: IAM Identity Center (पूर्वीचे AWS SSO) — एकच sign-in, प्रत्येक account मध्ये roles बनणारे permission sets, आणि groups पासून accounts पर्यंत assignments. iam/demo.py मधील people().

🧒 5 वर्षांच्या मुलाला समजावल्यासारखे

शाळांच्या समूहात आता दहा शाळा आहेत. प्रत्येक शिक्षिकेला प्रत्येक शाळेत वेगळे कार्ड देणे म्हणजे प्रत्येकीला दहा कार्डे, आणि एखादी शिक्षिका सोडून गेली की कोणालातरी ती सगळी दहा शोधावी लागतात.

म्हणून समूह एकच front desk 🏢 उघडतो. शिक्षिका तिथे एकदाच sign in करतात. Desk ला कर्मचाऱ्यांच्या याद्या (groups) आणि एक तक्ता माहीत असतो: "शिक्षिकांच्या यादीला शाळा 1 आणि 2 मध्ये Teachers टोपी मिळते; IT यादीला सगळीकडे Admins टोपी". Sign in केल्यावर शिक्षिका एक शाळा आणि एक टोपी निवडते आणि अल्पकाळाचा पास घेऊन आत जाते.

एखादी शिक्षिका सोडून गेली की desk तिचे नाव एकदाच खोडतो — आणि प्रत्येक शाळेचे दार तिच्यासाठी उघडणे बंद होते.

🗺️ आकृती

flowchart LR
    idp["👤 identity source<br/>Identity Center directory, AD, or Okta / Entra ID"]
    grp["📋 groups<br/>teachers-group · it-group"]
    ps["🎩 permission sets<br/>Teachers · Admins"]
    acct["🏫 accounts<br/>111122223333 · 444455556666"]
    role["AWSReservedSSO_Teachers_…<br/>a role in each assigned account"]
    idp --> grp -->|"1 assignment"| ps -->|"2 provisioned into"| acct --> role
    role -->|"3 sign in, get temporary credentials"| ok["✅ s3:GetObject"]

🗺️ काढलेली आकृती + एक lab: https://school-edh.pages.dev/iam/lesson-diagrams.html#l10

❓ काय

Identity source — Identity Center directory, Active Directory, किंवा SAML 2.0 द्वारे बाहेरचा identity provider (Okta, Microsoft Entra ID, Google Workspace, …), ज्यात users आणि groups SCIM ने sync होतात.
Permission set — policies चा नमुना (AWS managed, नावाने customer managed, inline, आणि पर्यायी boundary) आणि session चा कालावधी (1–12 तास).
Account assignment — (group किंवा user) + permission set + account. मग Identity Center त्या account मध्ये /aws-reserved/sso.amazonaws.com/ या path खाली AWSReservedSSO_<PermissionSet>_<suffix> नावाचा role बनवते. हे roles हाताने बदलू नका.
Sign-in — console साठी AWS access portal; CLI साठी aws configure sso आणि aws sso login, जे तात्पुरती credentials cache करते. CloudTrail session assumed-role/AWSReservedSSO_Teachers_…/aishwarya@school.example असे दाखवतो.
सोडून जाणारे — identity source मध्ये user disable करा; शोधायला कोणत्याही access keys नाहीत.
IAM users अजूनही कुठे बसतात — फक्त keys स्वीकारणारी काही third-party tools सारखी दुर्मीळ उदाहरणे; त्या कमी, मर्यादित आणि rotate केलेल्या ठेवा (धडा 12).

🤔 का

कारण लोक teams बदलतात आणि सोडून जातात, आणि प्रत्येक account मधला password आणि keys असलेला प्रत्येक IAM user म्हणजे विसरण्यासारखी आणखी एक गोष्ट. एक identity, अल्पकाळाचे role sessions, accounts शी जोडलेले groups: येणे, बदलणे आणि जाणे — प्रत्येकी एकच बदल होतो.

🔧 कसे (या repo मध्ये)

iam/demo.py मधील people() दोन groups ना दोन permission sets शी जोडते आणि प्रत्येक assignment कोणता role बनवते ते छापते, मग Teachers permission set च्या policy (read-reports) सह एका SSO session ARN चे मूल्यमापन करते: report वाचता येतो, EC2 terminate करता येत नाही.

🧪 करून पाहा

python3 iam/demo.py people
python3 - <<'EOF'
import sys; sys.path.insert(0, "iam"); from evaluate import decide, load
permission_sets = {"Teachers": [("read-reports", load("read-reports"))], "Admins": [("admin", load("admin"))]}
assignments = {"teachers-group": "Teachers", "it-group": "Admins"}
members = {"aishwarya@school.example": ["teachers-group"], "meera@school.example": ["it-group"]}
def sign_in(email, permission_set, action="ec2:TerminateInstances"):
    if permission_set not in [assignments[g] for g in members.get(email, [])]:
        return "no assignment, no role to assume"
    session = "arn:aws:sts::111122223333:assumed-role/AWSReservedSSO_" + permission_set + "_1a2b/" + email
    return decide(session, action, "*", identity=permission_sets[permission_set])[0]
print("aishwarya as Teachers:", sign_in("aishwarya@school.example", "Teachers"))
print("aishwarya as Admins:  ", sign_in("aishwarya@school.example", "Admins"))
print("meera as Admins:      ", sign_in("meera@school.example", "Admins"))
members["meera@school.example"] = []          # meera leaves: removed once, in the identity source
print("meera, after:         ", sign_in("meera@school.example", "Admins"))
EOF

खऱ्या account वर (AWS CLI आणि Identity Center instance लागतो; instance, permission set आणि group IDs उदाहरणादाखल आहेत):

aws configure sso                                           # asks for the start URL, region, account and permission set
aws sso login --profile school-teachers
aws sts get-caller-identity --profile school-teachers
aws sso-admin create-permission-set --instance-arn arn:aws:sso:::instance/ssoins-1111222233334444 --name Teachers --session-duration PT4H
aws sso-admin create-account-assignment --instance-arn arn:aws:sso:::instance/ssoins-1111222233334444 --target-id 111122223333 --target-type AWS_ACCOUNT --permission-set-arn arn:aws:sso:::permissionSet/ssoins-1111222233334444/ps-1111222233334444 --principal-type GROUP --principal-id a1b2c3d4-5678-90ab-cdef-EXAMPLE11111

✅ तपासा — तुम्हाला काय दिसायला हवे

people तीन 👥 ओळी छापते (teachers-group → एका account मध्ये Teachers; it-group → दोन्हीमध्ये Admins), मग ✅ aishwarya via SSO (Teachers) → read a report ALLOW आणि 🚫 aishwarya via SSO (Teachers) → terminate EC2 IMPLICIT DENY. तुमचा snippet छापतो IMPLICIT DENY (Teachers terminate करू शकत नाही), no assignment, no role to assume (aishwarya ला Admins assignment नाही), meera साठी ALLOW, आणि ती सोडून गेल्यावर no assignment, no role to assume. खऱ्या account वर get-caller-identity असा Arn दाखवतो ज्यात assumed-role/AWSReservedSSO_ असते.

🏁 तुम्ही आत्ताच काय सिद्ध केले

लोकांना group → permission set → account assignments मार्गे, अल्पकाळाच्या role sessions च्या रूपात access मिळतो — आणि एखाद्याला एकदा काढले की ती सगळीकडून निघते.

⚠️ नेहमीच्या चुका

"SSO set up होईपर्यंत" कर्मचाऱ्यांसाठी IAM users बनवणे — आणि ते कधीच न काढणे
groups ऐवजी users एकेक करून assign करणे
सगळ्यांसाठी एकच प्रचंड AdministratorAccess permission set
AWSReservedSSO_… roles थेट बदलणे — Identity Center त्यांच्यावर पुन्हा लिहिते

🏭 प्रत्यक्ष वापरात हे का महत्त्वाचे: joiner-mover-leaver हे एक audit control आहे. Identity Center कंपनीच्या directory शी जोडलेले असेल तर HR चा "leaver" event काही मिनिटांत AWS access काढून टाकतो — आणि credential report मध्ये एकही मानवी IAM user दिसत नाही.

⏭️ पुढे

प्रत्येकाला योग्य दारातून access आहे — पण त्यांच्याकडे जास्त तर नाही ना? Least privilege, अंदाजाने नव्हे तर मोजून.

git checkout lesson-11-least-privilege

🏢 Lesson 10 — People at scale: IAM Identity Center

📍 You are here: Lesson 10 of 12 · Previous: lesson-09-cross-account · Next: lesson-11-least-privilege

📦 What's in this branch

Lessons 01–09, plus how people should reach AWS: IAM Identity Center (formerly AWS SSO) — one sign-in, permission sets that become roles in each account, and assignments from groups to accounts. people() in iam/demo.py.

🧒 Explain like I'm 5

The school group now has ten schools. Giving every teacher a separate card at every school means ten cards each, and when a teacher leaves, someone must find all ten.

So the group opens one front desk 🏢. Teachers sign in there once. The desk knows the staff lists (groups) and a chart: "the teachers list gets the Teachers hat at schools 1 and 2; the IT list gets the Admins hat everywhere". After signing in, a teacher picks a school and a hat and walks in with a short-lived pass.

When a teacher leaves, the desk crosses them off once — and every school's door stops opening for them.

🗺️ Diagram

flowchart LR
    idp["👤 identity source<br/>Identity Center directory, AD, or Okta / Entra ID"]
    grp["📋 groups<br/>teachers-group · it-group"]
    ps["🎩 permission sets<br/>Teachers · Admins"]
    acct["🏫 accounts<br/>111122223333 · 444455556666"]
    role["AWSReservedSSO_Teachers_…<br/>a role in each assigned account"]
    idp --> grp -->|"1 assignment"| ps -->|"2 provisioned into"| acct --> role
    role -->|"3 sign in, get temporary credentials"| ok["✅ s3:GetObject"]

🗺️ Drawn version + a lab: https://school-edh.pages.dev/iam/lesson-diagrams.html#l10

❓ What

Identity source — the Identity Center directory, Active Directory, or an external identity provider (Okta, Microsoft Entra ID, Google Workspace, …) via SAML 2.0, with users and groups synced by SCIM.
Permission set — a template of policies (AWS managed, customer managed by name, inline, and an optional boundary) plus a session duration (1–12 hours).
Account assignment — (group or user) + permission set + account. Identity Center then creates a role named AWSReservedSSO_<PermissionSet>_<suffix> under the path /aws-reserved/sso.amazonaws.com/ in that account. Do not edit those roles manually.
Sign-in — the AWS access portal for the console; aws configure sso and aws sso login for the CLI, which caches temporary credentials. CloudTrail shows the session as assumed-role/AWSReservedSSO_Teachers_…/aishwarya@school.example.
Leavers — disable the user in the identity source; no access keys to hunt down.
Where IAM users still fit — rare cases like some third-party tools that only accept keys; keep them few, scoped and rotated (lesson 12).

🤔 Why

Because people change teams and leave, and every IAM user with a password and keys in every account is one more thing to forget. One identity, short-lived role sessions, groups mapped to accounts: joining, moving and leaving become one change each.

🔧 How (in this repo)

people() in iam/demo.py maps two groups to two permission sets and prints the role each assignment creates, then evaluates an SSO session ARN with the Teachers permission set's policy (read-reports): reading a report works, terminating EC2 does not.

🧪 Try it

python3 iam/demo.py people
python3 - <<'EOF'
import sys; sys.path.insert(0, "iam"); from evaluate import decide, load
permission_sets = {"Teachers": [("read-reports", load("read-reports"))], "Admins": [("admin", load("admin"))]}
assignments = {"teachers-group": "Teachers", "it-group": "Admins"}
members = {"aishwarya@school.example": ["teachers-group"], "meera@school.example": ["it-group"]}
def sign_in(email, permission_set, action="ec2:TerminateInstances"):
    if permission_set not in [assignments[g] for g in members.get(email, [])]:
        return "no assignment, no role to assume"
    session = "arn:aws:sts::111122223333:assumed-role/AWSReservedSSO_" + permission_set + "_1a2b/" + email
    return decide(session, action, "*", identity=permission_sets[permission_set])[0]
print("aishwarya as Teachers:", sign_in("aishwarya@school.example", "Teachers"))
print("aishwarya as Admins:  ", sign_in("aishwarya@school.example", "Admins"))
print("meera as Admins:      ", sign_in("meera@school.example", "Admins"))
members["meera@school.example"] = []          # meera leaves: removed once, in the identity source
print("meera, after:         ", sign_in("meera@school.example", "Admins"))
EOF

On a real account (needs the AWS CLI and an Identity Center instance; the instance, permission set and group IDs are examples):

aws configure sso                                           # asks for the start URL, region, account and permission set
aws sso login --profile school-teachers
aws sts get-caller-identity --profile school-teachers
aws sso-admin create-permission-set --instance-arn arn:aws:sso:::instance/ssoins-1111222233334444 --name Teachers --session-duration PT4H
aws sso-admin create-account-assignment --instance-arn arn:aws:sso:::instance/ssoins-1111222233334444 --target-id 111122223333 --target-type AWS_ACCOUNT --permission-set-arn arn:aws:sso:::permissionSet/ssoins-1111222233334444/ps-1111222233334444 --principal-type GROUP --principal-id a1b2c3d4-5678-90ab-cdef-EXAMPLE11111

✅ Verify — what you should see

people prints three 👥 lines (teachers-group → Teachers in one account; it-group → Admins in both), then ✅ aishwarya via SSO (Teachers) → read a report ALLOW and 🚫 aishwarya via SSO (Teachers) → terminate EC2 IMPLICIT DENY. Your snippet prints IMPLICIT DENY (Teachers cannot terminate), no assignment, no role to assume (aishwarya has no Admins assignment), ALLOW for meera, and after she leaves, no assignment, no role to assume. On a real account, get-caller-identity shows an Arn containing assumed-role/AWSReservedSSO_.

🏁 What you just proved

People get access through group → permission set → account assignments, as short-lived role sessions — and removing someone once removes them everywhere.

⚠️ Common mistakes

creating IAM users for staff "until SSO is set up" — and never removing them
assigning users one by one instead of groups
one giant AdministratorAccess permission set for everyone
editing the AWSReservedSSO_… roles directly — Identity Center overwrites them

🏭 Why this matters in production: joiner-mover-leaver is an audit control. With Identity Center connected to the company directory, HR's "leaver" event removes AWS access within minutes — and the credential report shows no human IAM users at all.

⏭️ Next

Everyone has access through the right door — but do they have too much? Least privilege, measured instead of guessed.

git checkout lesson-11-least-privilege

← Previouscross account Next →least privilege

This page is the lesson's README from the lesson-10-people-at-scale branch, shown here so the whole School stays on one site. Code files open on GitHub at the same branch.