Shadowing Practice: IAM 1 - Learn English Speaking with Video
בחר מצב תרגול
כל מצב פותח חדר תרגול במסך מלא.
97 משפטים
אם המשפטים קצרים או ארוכים מדי, לחץ על ערוך כדי להתאים אותם.
1
Hi everyone.
2
Today I'd like to walk you through AWS Identity and Access Management, or IAM.
3
Rather than treating IAM as just a place where we create users and attach policies, I want to look at it as the authorization control plane for AWS.
4
As engineers, we interact with IAM almost every day.
5
We use roles for EC2 and Lambda, temporary credentials through STS, Federation for CICD, and policies whenever one AWS service needs access to another.
6
So we'll look at how IAM evaluates requests, how roles and trust policies work, some production security patterns, and then we'll finish with a short live demo.
7
One useful thing to remember from the beginning is that IAM itself is a global service.
8
IAM is the authorization control plane.
9
Engineers use IAM indirectly almost everywhere in AWS.
10
Before we get into policies and roles, let's start with the problem IAM is actually solving.
11
What problem does IAM solve?
12
Before IAM, the basic access model would be difficult to operate at AWS scale.
13
Imagine developers sharing credentials, applications using permanent access keys,
14
and administrators manually reviewing permissions. That creates several problems.
15
Credentials live too long, access becomes difficult to trace, and delegation doesn't scale.
16
IAM changes that model.
17
Instead of giving everybody shared credentials, we define identities, policies, trust relationships, and short -lived sessions.
18
A good example is GitHub Actions.
19
Instead of storing an AWS access key in GitHub, GitHub can present an OIDC token.
20
AWS validates that identity, the workflow assumes an IAM role through STS, and AWS returns temporary credentials.
21
The pipeline gets only the permissions it needs, for only the period it needs them.
22
Move from shared permanent credentials to policy -based temporary access.
23
IAM provides the enforcement model, but engineers still have to design permissions correctly.
24
So with that problem in mind, what exactly is IAM?
25
What is IAM?
26
At a high level, IAM controls WHO can do what in AWS and under which conditions.
27
There are really three concepts I want you to keep in mind.
28
First, we have principles.
29
These can be users, roles, federated identities, or AWS services.
30
Second, we have policies.
31
Policies describe what actions are allowed or denied.
32
And third, we have sessions.
33
This is where STS becomes important because it gives us temporary credentials.
34
From a production perspective, roles are usually much more important than IAM users.
35
For workforce access, we would normally combine AWS with Federation or IAM Identity Center, rather than creating large numbers of individual IAM users.
36
and almost everything here can be managed through terraform
37
or another infrastructure as principle plus policy plus session a role is an im identity
38
that has both a trust relationship and permissions now let's look at what actually happens
39
when that identity calls an aws api
40
how im works request evaluation
41
if we follow the request flow from left to right it starts with a principle making a signed AWS API request.
42
That request has context.
43
AWS knows the action being requested, the resource, tags, source IP, MFA state, organization information, and potentially other condition keys.
44
Then the authorization engine evaluates the policies that apply.
45
The simple mental model is explicit deny wins.
46
After that, AWS looks for an applicable allow.
47
And if there is no allow, we end up with an implicit deny.
48
This explains one of the most common IAM troubleshooting questions.
49
Why am I getting access denied when this role has administrator access?
50
Because administrator access isn't necessarily the final decision.
51
An SCP, permissions boundary, session policy, resource policy, KMS key policy, or explicit deny may still restrict the request.
52
Explicit deny allow, otherwise implicit deny.
53
Always consider all applicable policy layers.
54
And that brings us to the IAM components we actually work with day -to -day.
55
Core components.
56
The easiest way to think about these components is by responsibility.
57
IAM users represent individual identities, although we try to avoid them for modern application access.
58
Groups organize permissions for users.
59
But in most production environments, roles are where things get more interesting.
60
A role can be assumed by an EC2 instance, Lambda function, another AWS account, GitHub Actions, Kubernetes workload, or federated user.
61
Then we have policies.
62
A permissions policy answers, what can this role do?
63
A trust policy answers a different question, who is allowed to become this role?
64
That's an extremely important distinction.
65
Finally, STS creates the short -lived credentials used during the role session.
66
Access Analyzer then helps us detect external access, unused permissions, and policy problems.
67
Permissions policy, what the role can do.
68
Trust policy, who can assume the role.
69
That trust relationship becomes especially important when we start talking about security.
70
Security deep dive.
71
Now let's talk about security, because this is probably the most important part of using IAM correctly.
72
On the left, we have the kind of trust relationship we generally want to avoid.
73
A wildcard principle effectively says that the trust boundary is extremely broad.
74
The safer pattern is what we're showing on the right.
75
We identify a specific federated identity provider, and then we add conditions.
76
With GitHub OIDC, for example, we can validate the audience and also restrict which repository, organization, or branch is allowed to assume the role.
77
There are several security layers working together here.
78
We may have an identity policy, a resource policy, a trust policy, a permissions boundary, an SCP, and possibly a session policy.
79
For third -party cross -account access, an external ID is another important control.
80
And for human administrative access, MFA should normally be part of the design.
81
The key idea is simple.
82
Don't just protect what the role can do.
83
Protect who can get into the role in the first place.
84
A secure IAM design controls both permissions and trust.
85
Wildcard trust should be treated very carefully.
86
And IAM becomes even more important when we see how many AWS services depend on it.
87
Integration with AWS services.
88
One reason IAM matters so much is that it isn't really a standalone service.
89
It's the shared authorization layer across AWS.
90
An EC2 instance can receive permissions through an instance profile.
91
Lambda uses an execution role.
92
EKS workloads can use IRSA or EKS pod identity instead of inheriting broad node permissions.
93
S3 combines identity policies with bucket policies.
94
KMS adds key policies and grants.
95
Organizations gives us SEP guardrails.
96
And CloudTrail provides the audit trail showing which identity, called which API.
97
In practice, a lot of IAM problems happen at these integration points rather than inside IAM itself.
הורד אפליקציה
כל מה שאתה צריך כדי לדבר בשטף
הגיית AIציון לכל משפט
תרגול IPAשלוט בכל צליל
אוצר מיליםבנה את מאגר המילים שלך
משחק אוצר מיליםלמד תוך כדי משחק
אותו ערוץ
FOR YOU
המלץ על סרטון
C11
74 משפטים
LangChain in 5 Minutes (Explained Clearly)
Daily ConversationUniversity StudentsWorking Adults
C11
537 משפטים
Understand Microsoft Entra ID | AZ-104 | Episode 2
Daily ConversationUniversity StudentsWorking Adults
C11
105 משפטים
AI Governance Explained: Ethical, Transparent & Accountable AI for the Future
Daily ConversationUniversity StudentsWorking Adults
C11
177 משפטים
Mini Project - Implementing a Simple Web Identity Federation Application
Daily ConversationWorking Adults
C13
111 משפטים
Executing Monitoring, Evaluation and Learning (MEAL) | Complete Practical Guide
Daily ConversationUniversity StudentsWorking Adults
C11
132 משפטים
Helpdesk to Sysadmin - 3 Things You Must Learn First
Daily ConversationUniversity StudentsWorking Adults
C13
360 משפטים
Terraform Scenario Based Interview Questions and Answers | DevOps Interview
Daily ConversationWorking Adults
C138 משפטים
"Dive Deep" Leadership Principle Explained by Amazon CEO Andy Jassy
Daily ConversationUniversity StudentsWorking Adults
C141 משפטים
🚨 Most organizations don't fail ISO/IEC 27001 because they don't understand the standard...
Daily ConversationWorking Adults
C11
207 משפטים
How I Made $30,000 Hacking Broken Access Control
Daily ConversationWorking Adults
C11
159 משפטים
Top 5 AI Gateway Use Cases | Solo.io
Daily ConversationWorking Adults
Vocabulary and speaking notes for this lesson
This video has 97 sentences and 1082 words to shadow. The speech runs for 7:36. The speaker talks at a steady 142 words per minute, a comfortable pace for shadowing. Only 75% of the words are among the 3,000 most common in English, so the vocabulary is demanding.
Key vocabulary in this video
15 words from the video worth learning, with pronunciation and meaning:
| Word | Pronunciation | Meaning |
|---|---|---|
| deny verb | /dəˈnaɪ/ | To disallow or reject. |
| temporary adjective | /ˈtɛmp(əˌɹ)ɛɹi/ | Not permanent; existing only for a period or periods of time. |
| principle noun | /ˈpɹɪn.sɪ.pəl/ | A fundamental assumption, fundamental law or guiding belief. |
| authorization noun | /ˌɔːθəɹaɪˈzeɪʃən/ | An act of authorizing. |
| layer noun | /ˈleɪ̯ɚ/ | A single thickness of some material covering a surface. |
| resource noun | /ɹɪˈzɔːs/ | Something that one uses to achieve an objective, e.g. raw materials or personnel. |
| component noun | /kəmˈpoʊ.nənt/ | A smaller, self-contained part of a larger entity. Often refers to a manufactured object that is part of a larger device. |
| boundary noun | /ˈbaʊndɹi/ | The dividing line or location between two areas. |
| administrator noun | /ədˈmɪn.ɪ.stɹeɪ.tɚ/ | One who administers affairs; one who directs, manages, executes, or dispenses, whether in civil, judicial, political, or ecclesiastical affairs; a manager. |
| explicit adjective | /ɪkˈsplɪs.ɪt/ | Very specific, clear, or detailed. |
| solve verb | /sɒlv/ | To find an answer or solution to a problem or question; to work out. |
| integration noun | /ˌɪn.tɪˈɡɹeɪ.ʃən/ | The act or process of making whole or entire. |
| correctly adverb | /kəˈɹɛk(t).li/ | In a correct manner. |
| applicable adjective | /əˈplɪk.ə.bəl/ | Suitable for application; relevant. |
| combine verb | /kəmˈbaɪn/ | To bring (two or more things or activities) together; to unite. |
Phrasal verbs you will hear
| Word | Meaning |
|---|---|
| work together verb | To be coworkers with someone; to share a workspace with someone. |
Pronunciation to watch
The speaker uses 8 contractions and reduced forms, such as isn't, we'll, doesn't. Say them the short way, as you hear them.
- The “sh” and “zh” sounds: authorization /ˌɔːθəɹaɪˈzeɪʃən/, integration /ˌɪn.tɪˈɡɹeɪ.ʃən/, potentially /pəˈtɛnʃ(ə)li/, execution /ˌɛk.sɪˈkjuː.ʃən/, evaluation /ɪˌvæljuˈeɪʃn̩/
- Long words — get the stress right: temporary /ˈtɛmp(əˌɹ)ɛɹi/, authorization /ˌɔːθəɹaɪˈzeɪʃən/, administrator /ədˈmɪn.ɪ.stɹeɪ.tɚ/, integration /ˌɪn.tɪˈɡɹeɪ.ʃən/, applicable /əˈplɪk.ə.bəl/
How to practise with this video
- Listen to the whole video once without speaking and note the words you do not know.
- Shadow it sentence by sentence at normal speed, repeating each one until your rhythm matches the speaker.
- Record yourself and compare with the original, paying attention to words like deny, temporary, principle.
מהי טכניקת השאדואינג?
שאדואינג היא טכניקת למידת שפה מבוססת מדע שפותחה במקור להכשרת מתורגמנים מקצועיים ופופולרית על ידי הפוליגלוט ד"ר אלכסנדר ארגואלס. השיטה פשוטה אך עוצמתית: אתה מקשיב לאודיו באנגלית ילידית וחוזר עליו בקול רם מיד — כמו צל העוקב אחרי הדובר עם עיכוב של 1–2 שניות בלבד. בניגוד להאזנה פסיבית או תרגילי דקדוק, שאדואינג מכריח את המוח והשרירים בפה לעבד ולשחזר דפוסי דיבור אמיתיים בו זמנית. מחקרים מראים שזה משפר משמעותית את דיוק ההגייה, האינטונציה, הקצב, הדיבור המחובר, הבנת השמיעה ושטף הדיבור — מה שהופך אותו לאחת השיטות היעילות ביותר להכנה לIELTS Speaking ולתקשורת באנגלית בעולם האמיתי.