Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Deep Dive on AWS Single Sign-On - AWS Online Tech Talks

1,451 views

Published on

Learning Objectives:
- Learn how to enable users to access their AWS accounts and business applications using their corporate credentials
- Learn how to manage SSO access to all of your AWS accounts managed in AWS Organizations
- Learn how to centrally manage user permissions to AWS resources when they access the AWS Management Console using AWS SSO

  • I’ve personally never heard of companies who can produce a paper for you until word got around among my college groupmates. My professor asked me to write a research paper based on a field I have no idea about. My research skills are also very poor. So, I thought I’d give it a try. I chose a writer who matched my writing style and fulfilled every requirement I proposed. I turned my paper in and I actually got a good grade. I highly recommend ⇒ www.HelpWriting.net ⇐
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • Hi there! I just wanted to share a list of sites that helped me a lot during my studies: .................................................................................................................................... www.EssayWrite.best - Write an essay .................................................................................................................................... www.LitReview.xyz - Summary of books .................................................................................................................................... www.Coursework.best - Online coursework .................................................................................................................................... www.Dissertations.me - proquest dissertations .................................................................................................................................... www.ReMovie.club - Movies reviews .................................................................................................................................... www.WebSlides.vip - Best powerpoint presentations .................................................................................................................................... www.WritePaper.info - Write a research paper .................................................................................................................................... www.EddyHelp.com - Homework help online .................................................................................................................................... www.MyResumeHelp.net - Professional resume writing service .................................................................................................................................. www.HelpWriting.net - Help with writing any papers ......................................................................................................................................... Save so as not to lose
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here

Deep Dive on AWS Single Sign-On - AWS Online Tech Talks

  1. 1. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Anand Murugesan, Sr. Product Manager 2/1/2017 AWS Single Sign-On (SSO) business
  2. 2. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Agenda • Challenges in managing cloud services access • Introducing AWS SSO • Pricing and availability • Demonstration • Q &A
  3. 3. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. How customers manage access to AWS accounts Employees • Permissions defined as policies • Attached to roles, users, and groups • Create AWS IAM users and assign permissions AWS account Permissions Amazon S3 buckets AWS Lambda functions Amazon EC2 instances Amazon RDS database instances
  4. 4. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Connect corporate directory Use it to control access to AWS resources through existing corporate Active Directory AWS account Permissions S3 buckets Lambda functions EC2 instances RDS database instances On-premises Microsoft Active Directory On-premises users and groups On-premises Active Directory Corporate data center
  5. 5. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Business scaling up Growing business • Demand for AWS resources • Different departments • Different purposes for same teams • Multiple AWS accounts provide security isolation Multiple AWS accounts
  6. 6. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Cloud applications for business agility Multiple AWS accounts On-premises users Business cloud applications SSO access SSO access
  7. 7. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Challenges Managing access to multiple AWS accounts and business applications is expensive, hard, and time-consuming. Managing multiple AWS accounts requires effort Hard to set up, operate, and use Numerous credentials No centralized security controls Access to business applications takes time and effort, and is expensive
  8. 8. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Challenges – Managing multiple AWS accounts Managing multiple AWS accounts requires effort • Maintain a list of AWS accounts • General-purpose SSO solutions treat AWS accounts as separate applications and don’t integrate deeply • SSO Setup – Cut-and-paste configuration across consoles • New account? Repeat the setup process. Can’t scale business quickly • Set up roles in each account. Keep the roles updated • Managing user access to accounts
  9. 9. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Challenges – Credentials and security control • Different password policies for different accounts and cloud applications • Numerous passwords–Password fatigue leads to weak passwords, writing down in cleartext • Access changes needs to be performed in cloud services manually • Removing access to cloud services is a manual process • Exposes critical business data to unauthorized access Numerous credentials No centralized security controls
  10. 10. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Challenges – Access to business applications • Setting up SSO and troubleshooting each application typically took days • In some cases, this setup could take weeks because it required you to communicate back and forth with application vendors • Vendor changes to the application configuration results in unexpected loss of access and requires changes to configuration and troubleshooting again • Requires you to understand the nuances of SAML integration Access to business applications takes time and effort, and is expensive
  11. 11. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Challenges – Hard to set up and manage • Prepackaged SSO software requires you to procure hardware and install OS and patches • Involves SSO software installation and ongoing patching and upgrade • High availability and security require expertise and time • Upfront investment and ongoing maintenance costs • Visibility into access requires manual reconciliation of data across multiple accounts, applications, and corporate directory • Hard for administrators and users to keep track of application access details Hard to set up, operate, and use
  12. 12. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Challenges - Summary Managing access to multiple AWS accounts and business applications is expensive, hard, and time-consuming. Managing multiple AWS accounts requires effort Hard to set up, operate, and use Numerous credentials No centralized security controls Access to business applications takes time and effort and is expensive
  13. 13. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Introducing AWS SSO Centrally manage single sign-on (SSO) access to multiple AWS accounts and business applications. Centrally manage access to multiple AWS accounts Easy to enable and use Use your existing corporate identities SSO access to business applications
  14. 14. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS Organizations – Account management A6 Development Test Production A8A1 A5 A4A3 A2 A9 A7 OU Allows you to organize AWS accounts Controls access to AWS services Apply service control policies OU OU Root
  15. 15. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Central access to AWS accounts Centrally manage access to multiple AWS accounts • Lists AWS accounts managed in AWS Organizations • Works with all AWS accounts and integrates deeply • SSO setup to AWS accounts is automatic. • New accounts are set up automatically • Provisions permissions into all AWS accounts • Manage access to all accounts from a central place
  16. 16. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS SSO - Central access to AWS accounts Centrally manage access to multiple AWS accounts AWS accounts managed in AWS Organizations AWS consoles OU = Development OU = Production Manage permissions to AWS accounts SSO access Permissions AWS SSO
  17. 17. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS SSO - Central access to AWS accounts • Connects to AWS Organizations and lists your AWS accounts • Allows filtering accounts by OU • Automatic SSO setup to AWS accounts • Centralized management of account permission sets • Define, apply, and reapply permission sets to all AWS accounts AWS accounts managed in AWS Organizations AWS consoles OU = Development OU = Production Manage permissions to AWS accounts SSO access Permissions AWS SSO
  18. 18. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Single password to access cloud services • Single corporate password works for cloud services • Stronger passwords improve security of cloud services • Access changes to cloud services as group membership changes in on-premises Active Directory • Immediate revocation of access to leaving employees. • Protects critical business data from unauthorized access Use your existing corporate identities
  19. 19. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS SSO – Connect your existing Active Directory AWS accounts managed in AWS Organizations AWS consoles OU = Development OU = Production Manage permissions to AWS accounts SSO access Permissions On-premises Microsoft Active Directory On-premises users and groups On-premises Active Directory Corporate data center AD Connector/ AD Trust AWS SSO
  20. 20. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AD AWS SE/EE AD Managed AD 1 On-premises Service account AD AD Connector 2 On-premises 1-way or 2-way trust AD Trust 3 Corporate Active Directory connection options Corporate Active Directory
  21. 21. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS SSO – Extends your existing business processes Groups On-Premises Active Directory Corporate data center User AWS accounts managed in AWS Organizations AWS consoles OU = Development OU = Production Map on-premises AD groups to accounts and applications
  22. 22. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Access to business applications • Preintegrated with commonly used cloud applications • Set up using simple step-by-step instructions • Vendor changes to the application configuration are taken care by AWS • Nuances of SAML integration simplified • Configure any SAML 2.0 application using application configuration wizard SSO access to business applications
  23. 23. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS SSO – Application configuration wizard Pick a preintegrated application Follow step-by-step customized instructions for each application Configure SSO Assign access 1 + 1 = 2C H S E
  24. 24. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Supports SAML 2.0 for custom applications Supports Security Assertion Markup Language 2.0 • Configure applications not in the preintegrated list • Internal applications built by you • Internal applications supplied by partners • Seamless access to applications during migration to the AWS Cloud SAML 2.0
  25. 25. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Easy to enable and use Easy to enable and use • No software or hardware needed • AWS managed service • No upfront investment or ongoing maintenance costs • Highly available service • Better visibility into access of cloud services using centralized auditing • Application access is instantaneous • Users can access cloud services from a central user portal
  26. 26. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Central place to access • One place to find all: • AWS consoles • Business applications • Custom internal applications • Easily search and find applications • No need to distribute or remember URLs or roles • Single corporate credentials give access to cloud services
  27. 27. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Centralized auditing • Audit all SSO access in AWS CloudTrail • Increased visibility into users’ SSO access to AWS accounts and cloud applications
  28. 28. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Pricing and availability • Included with your AWS accounts at no additional charge • Public Preview in the US East (N. Virginia) Region
  29. 29. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Demonstration
  30. 30. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Questions?

×