AWS Security Token Service: A Practical Tutorial

[@salva_next]

Great, that level of things, are complex, but with a good base is easy to understand thanks to your explanations, perfect procedure, and easy to read c# code. Really thanks!!

[@stevenlewis8782]

User -> policy -> role -> policy -> resource ... phew! Seriously, though, this is very helpful. I like the code demo at the end.

[@impostersyndromedev]

Nice summary! It does feel like a bit much doesn’t it 😅

[@stevenlewis8782]

@@impostersyndromedev At scale you want lots of smaller things, so I don't think it's too bad.

[@senolerd]

The first role creation page, at 2:11, ""Select trusted entities" part is all about STS. If you create the role with default trusted entities, the "AWS": "{account_id}" will be updated automatically to "AWS": "arn:aws:iam::{account_id}:root". To confirm this, create a role same way, then check back same role's "Trust relationship" after the creation. So, end of the video "StdUser" is having same privileged with root to this function!! Role creation journey should be done with two steps, policy -> role (with "AWS": "arn:aws:iam::{account_id}:user/StdUser). You are still getting STS' temporary credentials for your application (aws-cli/sdk). For further users; Thrust Relationship's Statement/Principal/AWS property also accepts list of user ARNs as string like ["{user1_ARN}", "{user2_ARN}"]

[@pipasbr]

Very good! works well, thanks bro

[@mars09]

I saw that you gave 'AssumeRole' at 3:28 with Principal as anyone in the AWS Account while creating the role and then you created a policy "StsDemoAssumeRolePolicy" which you then added to that specific user. Is it redundant and unnecessary?

[@impostersyndromedev]

Yup. I mentioned it rather quickly in the dialog, but it's good that you caught that! Setting this would give you defense in depth. Particularly useful, in the event that new users are added or removed that shouldn't be able to assume the role.

[@venkateshpolisetty8072]

Hey. Nice Explaination. I have a question. I am the admin user in the aws account. I don't have any access key and secret key. I want to access s3 using temporary credentials. is it possible?

[@RocketFanPro]

Who’s buying some aws then

[@GuilhermeCesarMedeiros]

Would you have the code?

[@dinirangapremanayake3873]

can you give this code in javascript

[@impostersyndromedev]

I think you can just select Node.js for that. You can see it in the dropdown at 1:22 -- hope that helps!

[@agustin7535]

Too complex

[@impostersyndromedev]

Certainly! This is why it's essential for us to embrace automation and infrastructure-as-code using tools like Terraform or Cloud Formation. At some point, somebody will need to figure out the hard or complex things and make them easier through abstraction and encapsulation. That's why they pay us the big bucks. Happy coding! :)