쉐도잉 연습: IAM 1 - 영상으로 영어 말하기 배우기

Hi everyone.

Today I'd like to walk you through AWS Identity and Access Management, or IAM.

Rather than treating IAM as just a place where we create users and attach policies, I want to look at it as the authorization control plane for AWS.

As engineers, we interact with IAM almost every day.

We use roles for EC2 and Lambda, temporary credentials through STS, Federation for CICD, and policies whenever one AWS service needs access to another.

So we'll look at how IAM evaluates requests, how roles and trust policies work, some production security patterns, and then we'll finish with a short live demo.

One useful thing to remember from the beginning is that IAM itself is a global service.

IAM is the authorization control plane.

Engineers use IAM indirectly almost everywhere in AWS.

Before we get into policies and roles, let's start with the problem IAM is actually solving.

What problem does IAM solve?

Before IAM, the basic access model would be difficult to operate at AWS scale.

Imagine developers sharing credentials, applications using permanent access keys,

and administrators manually reviewing permissions. That creates several problems.

Credentials live too long, access becomes difficult to trace, and delegation doesn't scale.

IAM changes that model.

Instead of giving everybody shared credentials, we define identities, policies, trust relationships, and short -lived sessions.

A good example is GitHub Actions.

Instead of storing an AWS access key in GitHub, GitHub can present an OIDC token.

AWS validates that identity, the workflow assumes an IAM role through STS, and AWS returns temporary credentials.

The pipeline gets only the permissions it needs, for only the period it needs them.

Move from shared permanent credentials to policy -based temporary access.

IAM provides the enforcement model, but engineers still have to design permissions correctly.

So with that problem in mind, what exactly is IAM?

What is IAM?

At a high level, IAM controls WHO can do what in AWS and under which conditions.

There are really three concepts I want you to keep in mind.

First, we have principles.

These can be users, roles, federated identities, or AWS services.

Second, we have policies.

Policies describe what actions are allowed or denied.

And third, we have sessions.

This is where STS becomes important because it gives us temporary credentials.

From a production perspective, roles are usually much more important than IAM users.

For workforce access, we would normally combine AWS with Federation or IAM Identity Center, rather than creating large numbers of individual IAM users.

and almost everything here can be managed through terraform

or another infrastructure as principle plus policy plus session a role is an im identity

that has both a trust relationship and permissions now let's look at what actually happens

when that identity calls an aws api

how im works request evaluation

if we follow the request flow from left to right it starts with a principle making a signed AWS API request.

That request has context.

AWS knows the action being requested, the resource, tags, source IP, MFA state, organization information, and potentially other condition keys.

Then the authorization engine evaluates the policies that apply.

The simple mental model is explicit deny wins.

After that, AWS looks for an applicable allow.

And if there is no allow, we end up with an implicit deny.

This explains one of the most common IAM troubleshooting questions.

Why am I getting access denied when this role has administrator access?

Because administrator access isn't necessarily the final decision.

An SCP, permissions boundary, session policy, resource policy, KMS key policy, or explicit deny may still restrict the request.

Explicit deny allow, otherwise implicit deny.

Always consider all applicable policy layers.

And that brings us to the IAM components we actually work with day -to -day.

Core components.

The easiest way to think about these components is by responsibility.

IAM users represent individual identities, although we try to avoid them for modern application access.

Groups organize permissions for users.

But in most production environments, roles are where things get more interesting.

A role can be assumed by an EC2 instance, Lambda function, another AWS account, GitHub Actions, Kubernetes workload, or federated user.

Then we have policies.

A permissions policy answers, what can this role do?

A trust policy answers a different question, who is allowed to become this role?

That's an extremely important distinction.

Finally, STS creates the short -lived credentials used during the role session.

Access Analyzer then helps us detect external access, unused permissions, and policy problems.

Permissions policy, what the role can do.

Trust policy, who can assume the role.

That trust relationship becomes especially important when we start talking about security.

Security deep dive.

Now let's talk about security, because this is probably the most important part of using IAM correctly.

On the left, we have the kind of trust relationship we generally want to avoid.

A wildcard principle effectively says that the trust boundary is extremely broad.

The safer pattern is what we're showing on the right.

We identify a specific federated identity provider, and then we add conditions.

With GitHub OIDC, for example, we can validate the audience and also restrict which repository, organization, or branch is allowed to assume the role.

There are several security layers working together here.

We may have an identity policy, a resource policy, a trust policy, a permissions boundary, an SCP, and possibly a session policy.

For third -party cross -account access, an external ID is another important control.

And for human administrative access, MFA should normally be part of the design.

The key idea is simple.

Don't just protect what the role can do.

Protect who can get into the role in the first place.

A secure IAM design controls both permissions and trust.

Wildcard trust should be treated very carefully.

And IAM becomes even more important when we see how many AWS services depend on it.

Integration with AWS services.

One reason IAM matters so much is that it isn't really a standalone service.

It's the shared authorization layer across AWS.

An EC2 instance can receive permissions through an instance profile.

Lambda uses an execution role.

EKS workloads can use IRSA or EKS pod identity instead of inheriting broad node permissions.

S3 combines identity policies with bucket policies.

KMS adds key policies and grants.

Organizations gives us SEP guardrails.

And CloudTrail provides the audit trail showing which identity, called which API.

In practice, a lot of IAM problems happen at these integration points rather than inside IAM itself.

✨ 추천 영상

153 문장

이 레슨의 어휘와 말하기 포인트

이 영상에는 섀도잉할 문장 97개와 단어 1082개가 있습니다. 말하는 구간의 길이는 7:36입니다. 화자는 분당 약 142단어의 일정한 속도로 말해서 섀도잉하기에 편한 속도입니다. 영어에서 가장 많이 쓰이는 3,000단어에 속하는 단어가 75%뿐이라 어휘가 어려운 편입니다.

이 영상의 핵심 어휘

영상에 나오는 익혀 둘 만한 단어 15개를 발음, 뜻과 함께 정리했습니다.

단어	발음	뜻
deny 동사	/dəˈnaɪ/	부정하다, 부인하다
temporary 형용사	/ˈtɛmp(əˌɹ)ɛɹi/	일시적인
principle 명사	/ˈpɹɪn.sɪ.pəl/	원리, 원칙
authorization 명사	/ˌɔːθəɹaɪˈzeɪʃən/	허가, 인가
layer 명사	/ˈleɪ̯ɚ/	층
resource 명사	/ɹɪˈzɔːs/	자원
component 명사	/kəmˈpoʊ.nənt/	부분
administrator 명사	/ədˈmɪn.ɪ.stɹeɪ.tɚ/	관리자
explicit 형용사	/ɪkˈsplɪs.ɪt/	명백(明白)하다, 명확(明確)하다
solve 동사	/sɒlv/	해결하다
integration 명사	/ˌɪn.tɪˈɡɹeɪ.ʃən/	통합, 융합
correctly 부사	/kəˈɹɛk(t).li/	정확(正確)히
applicable 형용사	/əˈplɪk.ə.bəl/	적용할 수 있는
combine 동사	/kəmˈbaɪn/	조합하다, 결합하다
evaluate 동사	/ɪˈvaljʊeɪt/	평가하다

주의할 발음

화자는 isn't, we'll, doesn't 같은 축약형과 약화된 형태를 8번 사용합니다. 들리는 대로 짧게 발음하세요.

“sh”와 “zh” 소리: authorization /ˌɔːθəɹaɪˈzeɪʃən/, integration /ˌɪn.tɪˈɡɹeɪ.ʃən/, potentially /pəˈtɛnʃ(ə)li/, execution /ˌɛk.sɪˈkjuː.ʃən/, evaluation /ɪˌvæljuˈeɪʃn̩/
긴 단어 — 강세 위치에 주의: temporary /ˈtɛmp(əˌɹ)ɛɹi/, authorization /ˌɔːθəɹaɪˈzeɪʃən/, administrator /ədˈmɪn.ɪ.stɹeɪ.tɚ/, integration /ˌɪn.tɪˈɡɹeɪ.ʃən/, applicable /əˈplɪk.ə.bəl/

이 영상으로 연습하는 방법

먼저 말하지 않고 영상을 끝까지 듣고 모르는 단어를 적어 둡니다.
보통 속도로 한 문장씩 섀도잉하고, 화자의 리듬과 맞을 때까지 반복합니다.
자신의 목소리를 녹음해 원본과 비교하고, deny, temporary, principle 같은 단어에 특히 주의합니다.

쉐도잉이란? 영어 실력을 빠르게 키우는 과학적 방법

쉐도잉(Shadowing)은 원래 전문 통역사 훈련을 위해 개발된 언어 학습 기법으로, 다언어 학자인 Dr. Alexander Arguelles에 의해 대중화된 방법입니다. 핵심 원리는 간단하지만 매우 강력합니다: 원어민의 영어를 들으면서 1~2초의 짧은 지연으로 즉시 소리 내어 따라 말하는 것——마치 '그림자(shadow)'처럼 화자를 따라가는 것입니다. 문법 공부나 수동적인 청취와 달리, 쉐도잉은 뇌와 입 근육이 동시에 실시간으로 영어를 처리하고 재현하도록 훈련합니다. 연구에 따르면 이 방법은 발음 정확도, 억양, 리듬, 연음, 청취력, 말하기 유창성을 크게 향상시킵니다. IELTS 스피킹 준비와 자연스러운 영어 소통을 원하는 분들에게 특히 효과적입니다.

섀도잉 방법: 단계별 전체 가이드 읽기 →

쉐도잉 연습: IAM 1 - 영상으로 영어 말하기 배우기

S3 Speech1 short

Understand Microsoft Entra ID | AZ-104 | Episode 2

AWS Machine Learning Engineer Associate: What You Need to Know

Top 5 AI Gateway Use Cases | Solo.io

Mini Project - Implementing a Simple Web Identity Federation Application

DHH has gone completely off the rails...

Incident Management Process: A Step by Step guide

The Man Who Stole MySpace | Samy

AI Governance Explained: Ethical, Transparent & Accountable AI for the Future

How to Use Google Gemini Al (Full Tutorial)

Terraform Scenario Based Interview Questions and Answers | DevOps Interview

Executing Monitoring, Evaluation and Learning (MEAL) | Complete Practical Guide

이 레슨의 어휘와 말하기 포인트

이 영상의 핵심 어휘

주의할 발음

이 영상으로 연습하는 방법

쉐도잉이란? 영어 실력을 빠르게 키우는 과학적 방법