AWS organizations and service control policies

In this workshop Hamid Nazari from Innablr (https://innablr.com.au/) will show us how to develop a multiaccount centrally-managed AWS setup that allows its sub-accounts' users to manage their own IAM Roles and Policies without introducing Privilege Escalation vulnerabilities.

We will touch on the following services:

• AWS Organizations
• CloudFormation StackSets
• Amazon IAM
• Service Control Policies

Prerequisites and Requirements:

• AWS Account (https://aws.amazon.com/account/)
  This account should not be part of an Organization. We must be able to create sub AWS accounts through Organizations. If your account is already part of an Organization, please do not use it, instead create a new one*. If you are not sure and want to check, log in to your AWS account and go to Organizations.
• A Gmail account! While this has nothing to do with what we’re building, we can use the ‘+’ character trick to easily create multiple accounts while using one inbox.
• Laptop (fully charged, as we can't guarantee outlets will be available)
• *nix Operating System (or be prepared to simultaneously translate the code to PowerShell as we go)
• Make
• Amazon CLI

• If you need to create an AWS account, you'll need a valid credit card. Sometimes account creation can take up to 24 hours, so please make sure you are prepared prior to the event.

We would like to thank Amazon Web Services for providing the venue and food for this workshop.