Hello and welcome to another episode of the Identity Navigator. I am your host and my name is Rohit. We are going to be talking about AWSI today and I plan to introduce you to all the key concepts so that you can show up well in any conversation and be able to quickly scale up on whatever you are asked to do next in your job. But let's talk about more important things in life. Let's talk about money. Let's talk about sponsorship. So here is the deal. I am getting a lot of compliments and emails saying how awesome my work is and how much value you are getting out of it. I am getting a ton of love but when it comes to putting their money where their mouth is suddenly everyone is acting like they have lost their wallet. It's like there isn't already a million other podcast out there doing it for free. So here is the thing. If you want to keep the good times rolling, think about sponsoring me please. That sounded inappropriate. So let me stick to the things that I know which is identity and access management. To remain relevant in IAM, one must grasp both IAM within the cloud and IAM concerning the cloud itself. For people starting out this is a great advantage because they are learning the new concepts as they were intended to. For very experienced professional and I speak of experienced not in terms of years of service but your level of knowledge. So for experienced professional the underlying concepts remains the same and their experience with varied technology and deep understanding of IAM mostly carries them through in this era of cloud computing. But for people with a little bit of experience, a good amount of knowledge but haven't really mastered their craft yet. This becomes exponentially more difficult because now first you need to understand cloud computing. Then IAM in the cloud, then IAM of the cloud. At the same time you also have to learn about so many other things that previously were not your responsibilities but now you must know of them. At the same time you also tend to correlate on-prem terms and concepts with the cloud terms and concepts and sometimes it doesn't match which increases the confusion even further. Now cloud computing, IAM in cloud, IAM of the cloud. All of these terminologies and terms and technologies are a wonderful rabbit hole to go into. Believe me when I say that I have wasted hundreds of hours going from one block post to another block post because something else caught my eye. But this is only possible for people with endless amount of time. So I thought we'll talk about AWS IAM today. Don't be misguided. This will not be the resource that will make you an AWS IAM expert. But my plan or my hope is to introduce all the concepts starting from the cloud computing all the way up to AWS IAM and comparing them with the on-prem concepts so that you now have a logical mind map before diving into those actual learnings yourself. And putting some boundaries as to these are the things that you need to learn. Anything apart from it is always a bonus but you really shouldn't if you are running short of time. So for people with limited amount of time or outside commitments this would allow you to upscale efficiently and put some guard rails around what you absolutely need to learn to be a cloud IAM expert. If you are like me though you have too much time on your hands and you have no life I would recommend rabbit holes because they are such a wonderful place to be. So while prepping for this episode I realized that one episode may not be enough. So I'll try to create a three part series. We'll start from the basic cloud concepts and I will specifically stick to AWS. This is because even though cloud computing as a whole. This has consistent underlying technologies but the terms sometimes are very very different and it would be very hard especially in an audio podcast to follow along if I do not stick to a particular cloud services provider. So I'll stick to AWS. So in the first part we'll talk about cloud computing. What do you absolutely need to know about it specifically from AWS perspective and then we will deep dive into AWS IAM. What are the basic terms and terminologies. What are the things that you should absolutely know. How do you carry out current state analysis for your organizations in the part two and part three of this series. So I hope you find some value out of this AWS IAM 101 series. So let's start from the very beginning. When I say very beginning it's the very beginning of cloud computing. Let's understand it in layman's term what is cloud computing. Imagine you have a computer at home. It has a limited amount of storage space and processing power. You can only store so many files and run so many programs advance before it starts to slow down. Now think of cloud computing as renting space and computing power on someone else is much bigger and much powerful computer which is connected to the internet. So now instead of storing your files and running your programs on your own computer you can store them and run them on this big computer in the cloud. So when you use cloud computing you are essentially using someone else's computer over the internet to store your data and run your applications. This allows you to access your files and programs from anywhere with an internet connection and you can scale up or down as needed without worrying about the limitations of your own computer. In simpler terms cloud computing is like renting a super super powerful computer on the internet to do all your computing tasks rather than relying solely on your own smaller computer at home. So this is in essence cloud computing. Now let's dive a little bit deeper because none of you listening to this podcast are layman. All of you are interacting and changing technology in some way or another in your daily lives and surely on your jobs. The cloud computing fundamentally transforms how computing resources are provisioned, managed and accessed. At its core it's about delivering computing services including servers, storage, databases, networking, software and more over the internet on a pay as you go basis. So here are some key aspects and benefits of cloud computing. Scalability and elasticity. Cloud platforms offer the ability to scale resources up or down based upon demand. This means you can easily handle spikes in traffic or demand without over provisioning resources, optimizing costs and improving performances. This is the entire concept behind why we move from dedicated servers to VMWares to Kubernetes clusters all the way up to the cloud. And Kubernetes are probably a fork but you do understand that we cannot.
not have resources provisioned for those edge cases of that spike in the traffic. So this is a much more manageable model for not over-provisiting stuff. Another concept is about resource pooling, which completely 100% is derived from the first concept of scalability in elasticity. So cloud providers maintain vast pool of computing resources that are dynamically allocated to users based on demand. This allows for efficient utilization of resources and enable users to access more computing power than they could afford to own and maintain individually. On-demand sales service, cloud users can provision computing resources, let's say a virtual server or a storage device, on demand without requiring human intervention from the service provider. This empowers engineers to quickly deploy and manage resources as needed, reducing time to market for application and services. So imagine telling an introvert like me who suffers from this extreme anxiety in talking to people that, hey, you have to call somebody to provision a VM image or an EC to instance. You sure as heck are not getting that call from me. So I am very, very thankful for this on-demand sales service model. Paper use pricing model. Cloud services typically operate on a paper use or subscription based pricing model. This means user only pay for the resources they consume, leading to cost saving compared to traditional IT infrastructure where resources are provisioned upfront regardless of actual usage. Flexibility and adaptability. Work platforms offer a wide range of services and tools to meet diverse computing needs, from hosting simple websites to running complex data analytics workloads. Engineers have the flexibility to choose the service that best fits their requirements and easily adapt as they need evolve or time. Cloud providers typically offer robust infrastructure with built-in redundancy and failover mechanisms to ensure high availability of services. This helps minimize downtime and ensures that application remains accessible even in the event of hardware failure or disruption of some other kind. And last but not least, security and compliance. Cloud providers invest heavily in security measures to protect data and infrastructure from unauthorized access, data breaches, and other security threats. Although with everything going out there, I am not so sure about this statement. They also offer compliance certifications and tools to help users meet regulatory requirements in various industries. So overall, cloud computing empowers engineers to focus on building and innovating applications rather than managing hardware and infrastructure. By leveraging the scalability, flexibility, and cost effectiveness of the cloud, organizations can accelerate their digital transformation efforts and drive business growth. This reminds me of something that we spoke in one of the earlier podcasts about this toolbox fallacy. So I told you all that while I was trying to learn Python, which was just a singular example. I was also at the same time hoping to buy a new laptop. So I was thinking, alright, I will buy a new MacBook Pro and then I will set it up in the perfect way possible. I will set up my Python environment and I would also need some sort of server to host my scripts. And let me create a perfect working environment. Let me create a plan and I was like just planning and planning and procrastinating because I wanted everything to be perfect before I really deep dive into learning Python. And this is what is called a toolbox fallacy. You want to have all the tools in the box before you even start doing something. And I still suffer from it though, but I am more aware of it. So how I ultimately ended up learning Python was I just opened a web browser on my old laptop and I said, hey, do we have I typed on the internet? Do we have any online IDE for Python that I could just run my scripts on I downloaded the Python API docs and that was pretty much it. That was good enough for me to be able to run Python and ultimately write some scripts eventually that are running into production today. So I did not need it that 32 GB MacBook Pro that I really hoped I would have before I started learning Python. And funny thing is I still I do not have that MacBook Pro and this is not for all of you. It is just if my wife is listening, she would probably know what would I need for my birthday next. But I digress let's talk about major players in cloud computing. No points for guessing. AWS Amazon web service widely regarded as the largest and most dominant cloud computing provider. We have Microsoft Azure Microsoft cloud computing platform providing a comprehensive suite of services for building deploying and managing applications and services. It is known for its strong integration with Microsoft software and ecosystem. And still hanging on is Google cloud platform which offers cloud computing services leveraging Google's infrastructure and expertise in data analytics and artificial intelligence. Even though GCP is not doing so bad, I personally expected a bit more from it. I'm pretty sure they could they would come back to me with a bunch of data that would make me eat my words. But I expected more of them. I do not see GCP as much as I see AWS or Azure out there in the market. It could just be me or my narrow group of contacts or it could be GCP as well. Then some other cloud providers worth mentioning is IBM cloud or a cloud. And last two is something that I really want to explore digital ocean. So it claims that it focuses on developers and startups or small enterprises. I plan to use them to deploy my next one page website hopefully very very soon. So if they are cheap, I'll probably spend a few bucks and test them out. So digital ocean is something that I really am looking forward to exploring more and I'll keep you guys aware of how it goes. In case any of you have any experience with it, I would love to get your thoughts on whether this is a worthwhile effort for me to explore them or I should just let it go. And last but not the least is Alibaba cloud. So I have personally no experience with it. A quick Google search said that this is probably more. But it has more adoption in the Asian markets. So if any one of you is listening from a country or a region where you are using Alibaba cloud, I would love to sit down with you. Coffee is on me. I would really like to understand as to how their services are because Alibaba is a major major name. And I'm really interested to find out what their cloud providers or cloud offerings are. Now let's deep dive into AWS. So what is AWS? AWS stands for Amazon Web Service and this is a cloud computing platform offered by Amazon. And like this is in the most obvious statement used ever. It provides a wide range of services that can help individuals and businesses to build and manage various types of applications and services in the cloud. So for beginners, AWS offers a vast array of resources and services that can be overwhelming at first. Right. It has got its compute services like EC2 and Lambda and Amazon ECS. It has got a storage services like S3 and EBS and glacier database services in RDS, DynamoDB, Redshift.
Networking, PVC, Route 53, AWS Direct Connect, developer tools, AWS code deploy, code commit, code pipeline, management tools, management console, cloud formation, cloud watch, security and identity services, AWS IM, AWS WAF, AWS Shield. Now I intensely went through all of it so quickly because this is how overwhelming it is for an IM engineer who has been working on cyber arc or sale point or a radical identity manager for the last 10 years to suddenly have to understand AWS IM and have to implement those and not just understand those. But why not? I'm here to talk you through all of these things in detail so you would have a good enough foundational understanding of what these are. And also, AWS does offer a free tier which allows you to a limited use of AWS services for free within certain usage limit. Additionally, AWS provides extensive documentation tutorial and training resources to help beginners get started with using their platform effectively. So if you haven't already used these free services to play around, create that free account today. If that is the one thing that you do from listening that podcast is create that free AWS account and use the services which are free play around with them. If nothing else, you would at least get an awareness of AWS management console. Right? Now let's talk about AWS. What are the foundational services of AWS? So these are four, there are four foundational services. Compute which is like processing powers. So in traditional terms, think about CPU and RAM and equate it to compute. So every time you hear compute, you think in terms of CPU and RAM. Second is storage. Right? Third is database. And fourth is network. Now, shouldn't storage be same as database or did you hear incorrectly? Now these are different concepts for AWS. So what are the AWS foundational services? They are compute storage databases and networks. Some of the terms that you want to be aware of in terms of computing. So let's deep dive a little bit more into computing. You already know when you hear computing, think CPU and RAM in traditional terms. If you are a Gen Z, just think computing please. Now in compute, you should be aware of few terminologies for the AWS. What are these? These are EC2, ECS, ECR, EKS, ELB. Let's look what does this alphabet soup means. So EC2 is elastic compute cloud. Like you have these virtual machines on your data center. These are the similar things on the cloud. EC2 allows you elastic compute cloud allows you to deploy virtual servers within your AWS environment. So what are the components of an EC2? Obviously you must have guessed that there should be an image type of thing. So this image is called Amazon, Amazon machine image or AMIs. So these are the baseline images with OS applications and custom configurations. Ten NC, which is another term in the EC2 components underlying host where this EC2 instance resides. So in normal data centers, you have a server and you put a VM image on top of it. So this server is related to ten NC and that VM image is AMI in the cloud. Use a data. What is this? This allows us to enter commands that will run during the first boot cycle. So you could actually run or put in some commands that would be run during the first boot cycle. So you could also have storage options like there could be persistent storage options where you can have an external hard disk attached or you could have an FMRL storage where you will have local storage or internal hard disk and then you will have your security components like SSH traffic and STT traffic and key value pair. It allows you to deploy virtual servers. These are AMI and NC use a data storage options and security. Another thing is the second thing that we spoke about in the alphabet soup was ECS. So ECS is EC2 container service. So EC stands for EC2 and then CS for container service. So this service allows us to run Docker enabled application, package as containers across the cluster of EC2 instances. So now you cannot have just images anymore. You need to think in terms of Docker images or QB images. And this ECS is that equivalent of running those EC2 components in a Docker enabled environment. Then you have your ECR which is elastic container registry. This is your secured location to store and manage to docker images. Devs can push pull and manage the library of docker images from this location. So what would be the components? Let's think through registry. That is this would be the location where images will exist. Authorization token. So for docker clients to authenticate to repository. Pository is an area and registry where different images and IAM policies can be applied. Repository policies which is like IAM policies which will come to it, come to that and then image which is a docker image stored in repository. And then you have your ECS which is elastic container service for Kubernetes. So far we have been thinking about TNC, you know that underlying operating system then VM and docker and Kubernetes. So this is all that is there is nothing more to it. Right. You would also have something called as AWS elastic bean stock which creates all dependencies for an application automatically. So trust me when I say it gives you a perfect developer platform. So you can just focus on solving the problem for your business. And it is so much more powerful your time to production should get decreased by a manner of 10s if not hundreds. So if you are taking 100 hour to go to production it should be 8 hours or 9 hours. Anything more you have to look at your process. Another thing that you should be aware of is AWS Lambda. So AWS Lambda is a serverless compute service which has been designed to allow you to run your application code without having to manage and provision your own EC to instance. So now I am telling you or basically Amazon is telling you hey don't even worry about AWS instance or your EC to instance right. You want to run something you want to run a service. I have an AWS Lambda for you where you can run your service without even have to worry about EC to instance. It's like they are giving us a server a web server or any other type of server in the cloud itself where we are just running our application code on it. And we also have something called as AWS batch. So these are the operations or batch that require large compute power and it runs on an ECS cluster. Right. Do you still remember what ECS was ECS was EC to container service. And then there is something else called as Amazon light sale. So lightweight used for simple websites apps or blogs with a few simple clicks VPS or a virtual private server can be created think of it like a lightweight EC to. So still I'm pretty sure if you are hearing it for the first time this is still hard to get EC to aka and blah blah blah. What you really need to get out of it is. AWS has a mechanism to provision virtual images which is called Amazon EC to instance. It has all the underlying concepts about the docus and the Kubernetes in which you're talking about images. It also has an options for directly just running your application code. Or you can also have a lightweight version of EC to sign I kid you not anything that you good think of Amazon on Amazon.
already will have a service for it. So there is no need for learning any of this. You just need to understand that Amazon would provide you anything that you need. And just understand that there are things like EC2 instances and container services and Docker services that are out there. And that would be more than enough to get you started. Now once you actually you have an application code to run and you are looking for a vessel as to where to deploy it. Now once you start looking into it, you can then identify, okay, do I need Lambda or do I need an EC2 instance here? And you can solve this problem when you get to this problem. Otherwise if you try to learn it today, I'm promising you that you are going to forget all about it. Let's talk about the second concept of load balancing. So we have this ELB service or it is called Elastic load balancing. It is like any other normal load balancing, which is managed by AWS and have the ability to scale up or scale down does Elastic. ELB types or Elastic load balancing types is application load balancer, which is operating at the request level. A network load balancer, which operates at the connection level and a classic load balancer, which operates at both the connection and request level. So again, you don't have to learn or memorize anything. You have to learn apologies, but you don't have to memorize anything. It just that you have to understand that there is a load balancing capability that AWS provides. Let's look into load balancer components. There would be a listener. What does that mean? So for every load balancer, regardless of the type used, you must configure at least one listener. The listener defines how your inbound connection are routed to your target groups based on ports and protocols, set as conditions. You also have your target groups. A target group is simply a group of resources that you want your ELB to route request to. So this is what load balancer sits in front of. Then there are rules which are associated to each listener that you have configured within your load balancing settings and they help to define how an incoming request gets routed to which target group. Health checks. The ELB associates a health check that is performed against the resources defined within the target group. And then you have your internal or internet facing ELBs. You could also have your ELB nodes. It associates itself with our ability zones that we will come back to. And then you also have your cross zone loads balancing where you can have your load balancing within different easy. So once you have to define a load balancer, then you will have to identify the type of load balancer and all of these components. So this would be very clear to you by looking at just any AWS documentation. You will get all the knowledge. But just at this moment, remember that there is something called as elastic load balancing, which is a normal load balancer services, which is provide and managed by AWS. Manage means AWS is accountable for its upkeep. If you need to learn anything here, learn the OSI model. So I always remember it by saying please do not throw the sausage piece away that physical layer and network layer and data layer and whatnot. So whatever floats your boat here, if you have to learn anything, you have to learn the seven step OSI layer. Then EC2 auto scaling through customizable and defined matrix, you can increase, scale out and decrease, scale in the size of your EC2 fleet automatically. To achieve this functionality, you would have to create a auto scaling group. Now we did touch upon the availability zone a little bit. Let's talk about AWS global infrastructure and what are its components? So there would be a room, right? Or there would be a shelf that houses a physical server that shelf would be in a room. There would be multiple rooms and those multiple rooms would be in a facility. That facility would be called as data center. Please do not quote me anywhere. I just wanted to make you a picture in your head about there are tons of shelves, racks, rooms, bunch of rooms and data center because everybody else will start from this concept of data center. So you have these data centers, which are Amazon's data centers. Now in one availability zone, multiple data centers exist. So one availability zone is associated with more than one data centers. So there would be like two data centers or three or five. These many data centers would exist within an availability zone, but that is not just the defining criteria. Every availability zone will also always have at least one other availability zone that is geographically located within the same area. And this is the most important part and this would answer why. And this connection between these multiple availability zones in the same geographical area is linked by highly resilient and very low latency private fiber optic connections. So think high availability, think act of gods, right. And that is why we need availability zones defined in this way. So multiple data centers are in availability zone. And another AZ also exists in the same geographical area and linked by highly resilient and in low latency private fiber optic connection. Then what comes above region? Often there are three, four or five availability zones linked together by these low latency connections. These localized geographical grouping of multiple AZs, which would include multiple data centers is defined as an AWS region. And then so let's go from a shelf to a region. There is a shelf, the shelf is in a room that room is in a facility that facility is called data center. This is where AWS definitions start. That multiple data centers plus some other conditions create an availability zone. Multiple availability zones plus some other conditions create a region. Then there are some other things that you need to also be aware of is edge locations. So edge locations are AWS sites deployed in major cities and highly populated area across the globe to cache data and reduce latency for end users access by using the edge locations. These are major cities, highly populated areas, New York City making a ton of requests for Uber. So Uber might want to have an edge location. So they can cache the data and reduce latency because pretty sure Uber would have their some things hosted. If they are using AWS, they would be using New York City data center, but an edge location is good to have there. Regional edge locations are regional edge cache has a larger cache width than each of the individual edge locations. Therefore when data is requested at the edge location that is no longer available, the edge location can retrieve the cache data from the regional edge cache instead of the original server which would have a higher latency. So what does that mean is you have all these data centers and availability zones and regions and whatnot. There is where in the data center, this is where everything else is logical. There's nothing called as region. You just picked three availability zones and started calling it a region. So it is just a logical concept region and availability zones and whatnot. But you have a data center. Now that data center might be far away from a location from which multiple requests are originating. So you can have an edge location there. That means you could have a cache around the same location. And then if that cache runs out, right, then what does it mean? Do that edge location needs to go back to the original server? Origin servers? No. Amazon actually puts in one more additional step of a regional edge cache. So if the data requested is not at the edge location, the edge location will not go to the original origin server, but it will go to the regional edge cache because that is still faster than going all the way back to the original server. Now the data is not there at the regional edge cache as well, then it will go back to the origin servers.
So, Amazon is building all this up for us. We do not need to do any of this. We just need to identify what are use cases is, which is typically the hardest part for the business. But I will went on it later. And as you look at the clock, we are almost a little over 40 minutes. So, hopefully you have found value in this. Next time let's deep dive into the remainder of the three Amazon services. And we will start looking into AWS IMS well. So, we will talk about as a compute. We have already spoken about this a little bit. We will go into storage. We will go into databases. And we will go into networks. Right? Thank you all for listening. I really appreciate all of you reaching out to me via LinkedIn or email. I am mostly very active on LinkedIn. So, you can always send me a request. If you just want to catch up, it would be great. If you want to send me an email, you can send the email to the identity
[email protected]. I am also very proud to announce that we have significantly crossed the 100 subscriber mark. So, I have got nothing to do with it. Thank you very much. It just made me feel good for a few days. So, I really appreciate you all clicking that subscribe button. If you don't mind, if you haven't already, please do that. Just a number that raises my spirits. So, I really appreciate that. We will carry out this AWS IM 101 series. We continue to have it at least for the next three to four episodes. Thank you for listening. This is Rohit, your identity navigator. [Music]
PodcastTranscript AI