Building the Multi-Account Org

0:00Governance, just saying that word, I feel like I should say it in a gruff, serious tone. Governance, like there should be a podium up here, maybe a clipboard, forms filled out in triplicate, binders stuffed with standard operating procedures that nobody actually uses. But hey, we can point to that stuff and say, hey, look at us, we have governance. And as long as it helps us sneak past one more of those bothersome audits, I suppose that's just what we have to endure because the executives say so.

0:32Unfortunately, this is how many organizations approach governance, a tax to be paid with little actual benefit. Now, before I got into this whole trainer thing, I spent 30 years in corporate IT across many different organizations. Some treated governance as a necessary evil, something to be tolerated. But a few did it right. And when it's done right, it is truly a beautiful thing to witness. It enables people, it accelerates workflows, lowers costs, and most importantly, it achieves the goals of what we're really after with governance, not just some corporate theater.

1:13My name's Scott, and welcome to Governance at Scale on AWS.

0:00Governance, compliance. Well, these things are the same thing, right? Well, no, not at all. Compliance is completely different than governance, but a lot of people kind of conflate the two to be the same thing. Compliance really is more about complying or obeying or doing a certain list of stuff that is considered best practice for one reason or another. And it varies based on industry and based on situation.

0:31So PCI DSS is a good example. If you happen to handle credit cards, payment cards, well, you're going to have to adhere to the best practices as part of the PCI DSS compliance program. SOC 2, same thing. HIPAA, same thing. Chances are you have encountered one of these programs in your career, and that may be why you're here taking this course right now. This course is not going to be a course on how to become SOC 2 compliant or how to become PCI DSS compliant.

1:09No, we're going to go through the tools and strategies that one can use on AWS to line yourself up to be compatible with one of these compliance programs or many of these compliance programs. Because the cool thing about AWS is that they have a ton of customers, and they have customers in all sorts of different industries and nationalities and situations, and they have all had to go through these particular compliance programs.

1:40So AWS is familiar with that, and they've done a lot of stuff to help you with your compliance needs for these programs. Governance is a bit different, and as I mentioned in the intro monologue there, some people refer to that as just bureaucracy. Maybe it's a bunch of rules. Maybe it's just a bunch of frustration and time wasted. So governance and compliance, is compliance the desired outcome of governance? Is compliance the end goal of governance?

2:13Is governance the end goal of compliance? Is it just a method to achieve? I prefer to look at it a little bit differently, and as a matter of fact, in my 30 years in corporate IT, one of the side quests I did for a short period of time is I was an internal auditor, and that gave me a totally different perspective on what is governance, what is compliance, and why we do the things we do. And the reality is that we've kind of contorted what governance is and what compliance is, and sometimes it's used as a hammer to kind of get things done in organizations, and that kind of leaves a bad taste in everybody's mouth.

2:52So they associate governance and compliance with the stick and not the carrot. But ultimately what we want is we want processes that are reliable, and stable, and secure, and cost efficient, and performant, and sustainable. And if these things right here sound familiar, well, yeah, they are the six pillars of the well-architected framework. And that is one of the things that AWS has used to build some of their governance tools around, so it fits very nicely with this particular approach.

3:27I like to think of it more as governance is just a set of consistent standards and practices that we can follow. We all agree to follow the same things, and that avoids anarchy and chaos. And compliance, on the other hand, is more so just the evidence that we're doing those things that we said we're going to do. And that's important because these compliance programs, ultimately, at the end of the day, what they're interested in is, are you living up to the standards that we have created in that particular standard?

4:00And if yes, well, then you get a green check, and you get to tell people that you are SOC 2 compliant. And depending on which industry you're in and what business you're in, that can have some very real commercial impacts, whether you're compliant or not. Compliance does not necessarily mean that you have a good governance, or you have good governance practices. Good governance, in my mind, is it has to be effective. It has to work. It has to achieve what it's trying to achieve.

4:30In most cases, that's those cost-effective, sustainable, reliable, stable, that sort of thing, those attributes. It's not just busy work for folks to do. It helps people do the right thing. In some of the best governance implementations I've seen, things are completely automated. And if you wanna spin up an AWS account, for example, you just hit a button, and it takes care of all the detail behind the scenes that we've defined as our corporate standards for standing up AWS accounts.

5:02And it does it very quickly. And whoever hit that button doesn't have to know anything about our standards, but the outcome is still the same. Another attribute of good governance is it's going to remove any sort of doubt, any sort of confusion. What should I do? Should I choose option A or option B? Well, we should lay those things out, and better so, maybe we make those choices for people, and that way they don't have to concern themselves with what do they choose, what classification, what data classification do they choose for this data that is confidential, for example.

5:37Good governance should have a clear outcome. Now, I can't tell you how many situations I've been in in different organizations where I say, hey, why do we do that thing? Oh yeah, we do that thing because somebody got an audit finding back in 1992, and we're really not sure why we do that thing anymore. Nobody told us to do anything different, so we just keep doing the thing. Well, that's a good example of maybe some governance that was put in place to put a bandaid on a situation, but was never really carried forward and updated.

6:08And that brings me to my next point here. It has to evolve and improve. Governance is not frozen in amber. It is dynamic. It is just like your organization. And unless you continually update those governance methods and procedures and processes, then you're going to see that come through in people viewing it as being just a bureaucracy that's outdated, and we just have to do it. You don't want to have your governance program turn into that. You want it to be active, alive, and continually improving.

6:42How are we going to go through this course? Well, let me introduce you to a startup here. And the startup's name is De-Synergize. And so they've come up with this little API here, and it's just a small little startup with a few folks. And the whole idea is that this API takes a bunch of corporate jargon and a bunch of junk, and we pass this through the De-Synergize API, and it spits out plain, actionable language. Now, I know many of us would love to have an API like this, and De-Synergize has created this, and they've gotten a lot of interest.

7:21Primarily, they've gotten interest because this little De-Synergize API here uses something they call Magic AI Dust. And somehow or another, they managed to get a patent on this Magic AI Dust, and that's how it does this remarkable task of converting bloated strategy documents into something that is actually understandable. Just between you and I, they use Bedrock behind the scenes. But that's neither here nor there. Pay no attention to whatever is behind the curtain over here.

7:53This is Magic AI Dust, and it apparently has garnered a lot of attention from various VCs. And so we have De-Synergize, who is this SaaS startup right now. Everything is in the founder's personal AWS account. They have some international customers from around the world. They also process sensitive business documents. So when companies use this API, they feed in maybe some of their corporate strategy stuff. So that is being handled, so that's something we have to watch for.

8:25There is aggressive VC interest because of AI. Ooh, AI. Well, we need to get in on that. And the best offer that has come in is from Vulture Ventures. And Vulture Ventures is a big venture capital company, and the term sheet has some specific conditions. And among those conditions is that De-Synergize has 90 days to demonstrate compliance with the Vulture Infrastructure and Security Standards, the VIZ.

8:58And that is what we're going to do in this course. We are going to help De-Synergize build out their AWS infrastructure and their AWS processes, such, number one, that we can meet the VIZ standards here, and number two, so that we can also meet the other regulatory standards that are out there for anyone just operating and doing business this way. So what are we going to do right now? Well, first, I want you to download and read over the VIZ guidelines. I've included that as an attachment in the downloadable content here.

9:31And you can read through that and see all the different requirements that we are going to have to help De-Synergize implement so that their deal can go through with Vulture Ventures. Next, we are going to take our very first step in doing some grown-up governance, and we are going to create our AWS organization. We're going to enable CloudTrail, we're going to create a budget alert, and we're going to implement IAM Identity Center. And you may be saying, well, why can't we just use an IAM user?

10:01Well, that is old school. We want to be new school. IAM Identity Center is the way that AWS is recommending that we interface with the console, and for the CLI, that matter, nowadays. And we don't need no stinking IAM users or access keys or stuff like that. So let's go.

0:00Once you've gotten yourself logged into your account using your root credentials, here we are. And one of the things I will point out here is if we go over here to security credentials, you really really really need to enable MFA. And my preference is usually to enable multiple MFA. And in my case, I have my password vault here that is using a one-time password. I have it also acting as a passkey. And then I also have my YubiKey set up as a passkey as well.

0:33One of the things that you'll notice here is I have my account. Oh, look at that. The account number. Oh, scary. You shouldn't show that account number. Well, I don't really care. There's two reasons why I don't care. Number one, by the time this course gets released, I'm going to have this account deleted. I go through accounts very often and that is not a bad thing. That's actually a good thing. And that's one of the things we're going to cover as we progress in this course is treating accounts as ephemeral and they can do a workload. Then when you're done, you can just shut them down. One of the threats out there is when accounts get open and they just stay out there and nobody pays any attention to them, yet they still have access to a bunch of stuff.

1:16That's when bad things happen. The second reason I don't really care if my account numbers get out there is AWS themselves do not consider your AWS account number to be confidential or sensitive. I'm not going to worry about it. So we are first going to set up AWS Organizations. So I'm just going to go out here to AWS Organizations and it's pretty simple to set up an organization. You have to have an account that you consider your management account. This is the main account where your AWS organization is going to be established. This doesn't mean that you have to set up all your stuff in your management account. As a matter of fact, it's considered best practice to set up stuff in several other accounts, not your main management account. That main management account is just for management. We're going to click on create an organization and that's that.

2:13So yeah, kind of anticlimactic, but what this has done is this has enabled us to do a bunch of different stuff. With AWS Organizations, we can manage many accounts at scale. We can apply different policies, we can apply different abilities and restrictions, and we're going to get into all that in other skills. But for now, what it has done here is it's created an organization and this is a structure that we can define. We have a root, every organization is going to have a root, and then our management account, that's us right here, just got dropped in the root. Now what we can do if we want to is we can create, click on that, create new, we can create new organizational units. And you can build out these organizational units in a variety of ways. We're going to create some more OUs and some more accounts in a future skill. So I'm not going to go into that right now, but this is step one. We just enabled AWS Organizations. This is going to be really central to how we're going to manage our AWS infrastructure and our AWS processes and services.

0:00All right, so we have just created our AWS organization here. Now we're ready to do some other stuff. And if I go over here to services, and if I scroll down through here, you'll see all these different services. What this means is that, for example, if I click on CloudTrail, I can enable the management of CloudTrail across all the accounts in my organization. And this being disabled right now does not mean that it's disabled in this management account. I can go out and enable CloudTrail in this management account.

0:32But enabling it here in the services within an AWS organization is going to let us manage that for the accounts that are part of our organization. And this is how you can achieve some pretty good commonization and centralization across all your organizations. You can define certain policies and services, how services are going to be implemented. And then you can deploy those configurations across different accounts or across specific OUs or against just one account, for example.

1:06But to get us started here, what I want to do is come down here to CloudTrail, and I am going to enable Trusted Access. Click that little box, enable, and Trusted Access has been enabled. And what that Trusted Access means is that the CloudTrail service is now going to have like an extra little setting or an extra little flag so that whenever we create an account under our AWS organization, it's going to say, oh, you have a centrally managed CloudTrail instance, so I'm going to wire you up for that.

1:40So I'm going to click on that right there. That's going to take us over to CloudTrail. Now, if you're not familiar with CloudTrail, it's one of those services that everybody should turn on from day one. And it monitors all the API access, every login, every logout, every permission add, any sort of things that you're doing inside your account, it is going to record. And that is very useful if you're trying to kind of backtrack and figure out, OK, we had a security problem.

2:12What happened? CloudTrail is going to store the logs in an S3 bucket. Going through the little wizard here, we can create a bucket on demand. I prefer to create my buckets manually. So I'm going to go out here to buckets, and we're going to create a bucket. And we're just going to use the account regional namespace here. That's just going to append our account number and a region here. I'm just going to say CloudTrail.

2:42There we go. And I'm going to leave everything else alone here. One of the things I do want to bring your attention to is the bucket key. And this is kind of important. If you happen to use KMS, in other words, the KMS version of the key versus the S3 version of a key. So for example, if we're using that right there, well, this bucket key is kind of important. Because what this means is if you're using KMS, whatever services interacting with the S3 bucket is going to ask KMS, hey, give me the encryption key.

3:18And it's going to give it to them. And it's going to come back and do the write or the read. The problem is, if you're doing that with logging, for example, then that's a lot of requests. And with those lot of requests, you can run over your allotted kind of free tier of KMS API requests. And it can start costing a lot of money. So what a bucket key is, is it's kind of a local copy of that KMS key, such that it doesn't have to go out to KMS and do the API. It can just use its local key.

3:50So I just want to be sure that the bucket key is enabled there. And I'm going to create my bucket. Now with my bucket created, I can hop over here to CloudTrail. And if I wanted a little walkthrough wizard here, I can click on this little button. The problem is that predefines what my bucket name is. So I don't want that. I'm just going to go back over here to Dashboard. I'm going to create a trail. And we're going to call this Management Events. And I'm going to check this little box right here, enable for all accounts in my organization.

4:20And this is going to take all the activity from all our accounts, present and future, and then log them into this S3 bucket. I'm going to say use an existing S3 bucket. And there's my bucket right there. Click on that. And I can have a prefix if I wanted to. I'm only going to use this bucket for this one purpose. So I'm not going to do anything here. So I am going to uncheck log file SSE KMS encryption. I don't really need KMS encryption now. Under some circumstances, you may be required to encrypt your logs.

4:51That's how you would do that. Log validation is pretty interesting. Again, sometimes this is in compliance programs. It says that we're going to have to make sure that our log files are not adulterated. In other words, once they've been recorded, we need to make sure or prove that they haven't changed. Somebody goes in there and changes them. So what this does is it creates a little hash file for that particular log file just to kind of validate that, yes, it is exactly how it was written.

5:22So I'm just going to scroll down here, click on Next. And now we get to the type of events that we want to log. We can also log in addition to management events. This is the stuff that you would trigger if you're logging in, if you're changing stuff, if you're using CLI commands, that sort of thing. We can also log data events. There's a caution here. Data events means, for example, any reads and writes to RDS. Well, if you have a database and you're logging every single read and write to that RDS database, that's a lot of stuff. So use this with caution, insights, network activity, that sort of thing.

5:57Same applies. Just really know what you're enabling here to make sure that you don't enable too much. So for API activity, I have both my read and my write enabled. And we're going to create the trail. That trail is now active. And it's an organizational trail. And for things to start showing up over here in CloudTrail, we're going to have to wait. Actually, we have some stuff already. Look at that. We have some CloudTrail activity.

6:29Well, not yet. So anyway, we have to wait a little bit for stuff to start showing up. And then once it shows up, you can just start poking around here and see how it logs that stuff.

0:00All right, our cloud trail is trailing. As a matter of fact, if I go in here and do some refreshes, you can see some activity has already been logged. And this is it right here. You can see it has json.gz. So if you want to, you can download this stuff and take a look at it. Another thing that I would really recommend when it comes to this particular bucket is consider some lifecycle management rules here. And we can define some lifecycle rules here that says, hey, I only need to keep this stuff out in this bucket for six months or something like that.

0:36And then maybe it deletes itself afterwards. You can do that with lifecycle rules. We're not going to get into the details there. There is also another function here that you can implement as well. Let's say that you need to capture what is in this bucket and not let anybody change it ever. Well, you can do that as well. You can put a lock on that. Again, we're not going to get into that, but that's just something that is available if you happen to have that requirement. So with our CloudTrail trailing, we are going to hop over into billing and cost management, and we are going to set up a billing alert.

1:12But one of the things I want to do before that is I want to go out here to the account, and I'm going to have this little workflow thing fly out here because I don't want to dox myself. There's some contact information down here. So what I want to do is in this account page, I'm going to flip down to here and let's see, not too far. Here, we can put that back on. And there we go. IAM user enroll access to billing information.

1:42And we want to edit this and we want to activate that. And this is going to allow us to see billing information when we're non-root users, if we assign that particular permissions. And we will because we are not going to use our IAM user. As a matter of fact, once we do these final things, we are going to say goodbye to our root user. We're going to take its password, lock it away in a vault somewhere, and we are never going to use this account again until we need to do a very small number of things that we can only do with a root user.

2:16And one of those things being close this account out. So let's go set up our billing alert here. And we're going to scroll down here to budgets and we can create a budget, click on that. And we have some different options here. We can do very customized budgets and very complex budgets. And this is something that you can really dig into if budgeting is something that is important to your organization, which I can't imagine many organizations are not obsessed about their budget.

2:46But anyway, for our purposes right now, we are going to use just a template here. And here are the templates that we have to choose from here. We have zero spend, monthly cost, and we have these two right here for reservations and savings plans. That has to do with some prepaid options that we can do using savings plans or reservations, or at least pre-contracted payments. And we don't need to mess with that right now. We are going to not do a zero budget. You can absolutely do this if you want to be sure that you're not spending anything, but we're going to do a monthly cost budget.

3:19And I'm just going to leave it here. And I'm going to say that our budget amount is going to be $50. And I'm going to include an email address in here. And what this is going to do is if we are approaching or exceeding this budget, it's going to send an email saying, hey, you better watch out. You're getting close to your budget. And it also has some other conditions as well. It can forecast your spend based on your current activities. And if you're going to reach 100% of your budget before the end of the month, it's going to notify you that as well.

3:54So we're just going to create a budget and there we go. This is something that I would recommend everybody do alongside enabling CloudTrail because people leave stuff running. I have left stuff running. This has saved my bacon many, many times. I'll get an email notification. Oh, shoot, I got to go out there and shut that thing down because I forgot it. So this is something you definitely want to enable.

0:00All right, so we have our budget alert in place. We have CloudTrail doing its thing. We now need to provide a way that we can get out from under using the root account to do stuff. It is not a best practice to use the root account for anything but the very special items that you need to use the root account because it's just too powerful. So we are going to use IAM Identity Center. And back in the olden days, you'd create an IAM user here, you'd come in here, then you go down to IAM users and create a user right here.

0:35Well, we don't need to do that. As a matter of fact, it's sitting here, encouraging you to go to Identity Center and that's exactly what we're going to do. I happen to be in US East 1 and that is perfectly fine for our purposes. If you want to be in a different region, you can be in a different region, but just remember that the region in which you set up IAM Identity Center kind of matters because it's something that can't be changed easily later on down the road. So I would probably pick whatever region you're primarily working in.

1:09And just as a little aside here, what I've learned through experience and talking with some AWS insiders is if you can help it avoid US East 1 because it's very congested, it's old, that sort of thing. I typically use US East 2 or US West 2, but I like to live dangerously. So we're going to go ahead and just enable it here in US East 1. Do we want to have a multi-region instance or a single region? For our purposes, a single region is just fine.

1:39You would probably use a multi-region if you wanted some redundancy there. And all this other stuff looks good. So we're going to enable it and it's going to take a little bit of time to enable all the goodies. I'm just going to pause the video until it finishes that. Actually, there, it already finished that stuff. So we're going to get rid of that. We're going to come down here to our instance name. I'm just going to give it a name here, De-Synergize. That's our company. And what I want you to draw your attention to here is these access portal URLs down here.

2:14You have a dual stack here and then regional IP and IPv4. And we are going to use these URLs to log in to our IAM Identity Center. But of course, to do that, we have to create some users. So I'm going to go over here to users. I'm going to add a user, get rid of that right there. And I'm going to create myself a user. And I'm going to put in my email address here and of course, confirm it. First name, last name.

2:47And it kind of concatenates that together to a display name. What we are creating here is we are creating a directory user. This is a directory that we can use for other stuff. If you expand out here, you see phone number. We have some job related information, title, employer number, cost center, that sort of thing. And later skills, we're going to make use of this to do some very interesting things. So for now, we're not going to add anything in there. I'm just going to leave this as is. One of the things you'll note here is that it's going to send us a password or it's going to send us an email with instructions to set up a password.

3:24So I'm just going to click on next and we have no groups right now. So I'm going to create a group. There we go. And let's just create a group called admins. We'll use administrators. And then I'm just going to create that group. And if I go back over here, refresh, I can select administrators, click on that. Everything's cool. Add that user. So it should have just sent me an email. I am going to pause the video. I'm going to go check my email box and I'm going to process whatever request it is asking me to do.

3:58Okay, I have successfully set my password there. So I'm going to go back out here to the dashboard. If we log in with that user, we're not going to have access to anything. As a matter of fact, I will do that here and show you what we have. So it's asking us for a username and password. And it's asking me to register an MFA device. And I'm going to happily do that. See if I can register my YubiKey here.

4:30There we go. I'm just going to rename that. Done. And then we're going to be dropped off to a landing page. And this landing page is going to be empty. And that is because we haven't set up any sort of permissions for our user here. And let's do that next. So let's go back over here to our permission sets. And I'm going to create a permission set. And think about this as kind of like a role.

5:01This is a group of authorizations of abilities that we're going to assign to different IAM Identity Center users, or we could assign it to a group. So one of the nice things I like about Identity Center is it comes with a bunch of predefined policies here that we can assign. You can see Billing, Data Scientist, Power User. And these are good starting points. There's probably not anything on this list that you can use just as is, because you probably want to crank down the security a little bit more. But in our case, we're just going to use Administrator Access.

5:33I'm going to leave that checked. And we're just going to call this Administrator Access. And I'm going to come down here to Session Duration. And this is the timeout of that session. And one hour is a bit extreme. I'll be working along, then suddenly after an hour that I don't really keep track of, I'm prompted with a login screen where I got to log in again. And I don't like that. So I'm changing this to eight hours. You can change it to whatever you want. And click on Next, Create.

6:04And so we have this permission set right here. Now we can assign that permission set to our users and our accounts. So here's an account right here. And I'm going to click on that and drill into it. And you can see we have no assigned users or groups or permission sets. And I'm going to assign a user here. There we go. Next. And what permission set do I want to assign? That one right there. And that looks good. And it's in the process of doing that update.

6:34So now we have our user that has been assigned access to this administrator access for this account, this particular management account. You can see it right out there. So if I go back out here to my access portal and hit refresh, look at that. I have my management account and underneath it I have administrator access. And if I click on this, it's going to log me in. Why? Because I've already been authenticated through the portal right here. And this is the path that I want you to use to get into your accounts from now on.

7:10We don't need our root account at all. So just be sure you bookmark this. You can actually change this. You can make it something a little bit more friendly down here. I think it's under settings there. I think you can change what it says. Customize our AWS access portal URL. You can put like your company logo and stuff like that. So we're not going to hassle with that. Just do be sure to bookmark this and then use that to come back to this account and then log into your account using your MFA and your password and get access this way.

0:00At the end of every skill, I'm going to have a series of scenario-based questions. And the idea is for me to help you apply what we've learned in the skill to maybe a totally different scenario. And so this is no different. We have an organization that is implementing AWS organizations. They've enabled CloudTrail to collect all the information for all their accounts in their organization. And we're told here three months later, they create two new accounts. What do we need to do to enable CloudTrail to collect information from those new accounts?

0:35Do we need to create a new CloudTrail in each member account and mirror the organizational configuration? Well, we could absolutely do that. We could log into each account and create its own CloudTrail account in that account, and then log that out to an S3 bucket in that account. But that's not really the best way of going about it because that means we would have a bunch of isolated buckets full of CloudTrail information scattered throughout our enterprise. And while that is okay, that's not a terrible situation, at least we have CloudTrail going, it would be much, much better for us to have all that stuff consolidated. So we're not going to use that method at all. Could we enable CloudTrail in each new account and have it deliver to the same S3 bucket? Well, really the question we're being asked here is what must we do to ensure that management events get delivered to this CloudTrail log in our management account?

1:34And this is not something we have to do. Sure, we could do it, but we don't have to do that. The real solution here is nothing. We don't have to do anything. One of the benefits of enabling CloudTrail for AWS organizations is that any new accounts that get created, they're automatically going to be adopted into that CloudTrail logging stream. We can go up here, update the existing organizational trail to add the new accounts. Well, we don't need to do that either. Nothing is all we need to do. Next question, we're asked about the behavior of our budget notification. So we've set up a budget of $5,000 and we get a notification when it's at about 80%. And then a week later, the monthly spend reaches $5,200. So we have exceeded our budget. What's going to happen when we exceed our budget threshold? Does the budget automatically reset and create a new budget? No, it certainly doesn't do that. Wouldn't that be great if we reached 100% of our budget and it just automatically reset and raised the threshold?

2:40Does AWS automatically suspend our resources? No, no, this is not what happens in an email notification, especially the type of budget that we set up. That is purely a notification. That is not having any impact on our accounts. However, there is a way that we can set up some pretty significant measures. If we exceed a budget number, we could actually go out and shut systems down automatically. And we're going to get into that later in this course, but this is not something that we're dealing with for this particular budget notification. Does AWS throttle the APIs to help us save money? Well, no, they do not do that. This is my final answer. It just sends a notification email and goes about its business. Therefore, if you have a situation where you're collecting those emails or you're doing stuff with those emails, I would most definitely not send it to an individual email box, but rather maybe a group mailbox. So there's multiple people that can notice, hey, we're approaching or we have eclipsed our budget for the month, and therefore we need to go do something about it. It does not stop the spending. We have to do that ourselves.

3:55Okay. Another behavior or service behavior question here. We have an organization that is using IAM Identity Center and they have an administrator access managed policy with a one hour session duration. Well, the engineer logs in at 9 and promptly at 10.05, they get an error message, access denied. What's going on? Why are they getting this message? The administrator policy was detached from the permission set? No, that's not the case at all. There's a simpler explanation here. The SCP on the account has been modified. SCPs are something that we are going to talk about in the near future. They are service control policies. Basically, they are things that we can apply to our AWS organization to control who can do what. Well, if you didn't know what an SCP was, then maybe you thought this might be a reason. And if you did know what an SCP was, you most definitely thought that this is not a reason, but let's keep on going to see if something is more sensible here. The Identity Center session credentials expired after one hour. If we look up here, we have one hour session duration. So what happens whenever we log into IAM Identity Center is it issues us temporary credentials and those temporary credentials have an expiration.

5:16And if you remember when we set our IAM Identity Center up and the administrator access policy there, we set it for eight hours, but here they're using one hour. And what that means is after one hour, those credentials are going to expire and they are not going to be valid anymore. So therefore that explains why this engineer received this denied error. I'll look down here, EC2 services experiencing an outage. Well, that is a possibility, I suppose, but we're asked what is the most likely, and I would say this is the most likely reason for this particular access denied error. I hope this has been informative for you and I'd like to thank you for viewing.