Ravi Sir's Cards › AWS
AD authenticates; permission sets authorize
What is a VPC: your own private network inside one AWS Region, example ThreeTierVpc 10.0.0.0/16.
Read card text
What this card says
Why do we need it?
Thinking “AD replaces IAM policies” leaves accounts either locked or wide open.
What is it?
AD (or Entra ID) proves who you are (authentication). Identity Center permission sets decide what you may do in AWS (authorization).
AuthN vs AuthZ
How to do it
Connect or federate the directory, then still create least-privilege permission sets and account assignments.
Example
Finance AD group gets Billing permission set only; Developers get PowerUser on the dev account only.