AWS re:Invent 2019: Managing user permissions at scale with AWS SSO (SEC308)

AWS Organizations and AWS Single Sign-On (SSO) shifted the AWS cloud management model from separate accounts with unique identities to hierarchical accounts with common identities. Together they provide a simpler model to manage access within an account hierarchy, while providing users a portal from which to access their assigned accounts and roles. This session explains the latest AWS SSO security and administration features and best practices for managing permissions at scale, whether you administer your identities in AWS SSO or in Active Directory.

[anjalivas]

This video is a MUST WATCH for AWS SSO. So good.

[MatijaGrcic]

Great presentation, well structured, connecting all the AWS SSO features in a meaningful way.

[yustiono]

Excellent presentation, both contents and delivery. Thank you

[jamiet]

Hi guys... great session and nice to see this offering moving forwards. Is there any movement on the cli & API automation for permission sets? I think Ron referred to them as the entitlement API. This is key to SSO being feasible for large organizations.

[nexus]

Maybe it's just me, but I found the part around defining permissions in AWS was just quickly passed. You bring in the Azure accounts and permissions and I assume for these permissions you can then map these to one or more IAM policies is that correct? It seems like the last bit in that permission screen was skipped and only briefly mentioned in a sentence.

[gauravwadhwa]

With respect to AWS SSO with Microsoft AD domain services part of the session, let me know if there is any other source for more details on it. would like to get more understanding and practical implementation of it

[anjalivas]

52:03 How does Cognito come into play
thank you Ron Cully