Hello and welcome to this lecture, and before we get into the meat of the course which focuses on access control elements surrounding AWS databases, I feel it’s important we have a grasp of Authentication and Authorization.  

When talking about security, I find that there is always a lot of confusion around the definition and meaning of the words authentication, authorization, and access control. Many people believe they all mean the same thing with no clear distinction between them. This is, however, untrue, and as a result, people often use the wrong term to describe their security mechanisms. In this lecture I want to cover each of these to help you understand the differences. It's important to know these differences in order to control access to your cloud resources effectively and with the appropriate level of security.

The authentication process consists of two parts of information. The first part of this process is to define who you are, effectively presenting your identity. An example of this would be your IAM user name to your AWS account. 

This identification is a unique value within the system that you are trying to authenticate to and in this example, AWS would not allow two identical user accounts to be created within this same single AWS account.  If you did try you would get this error message.

The second part of the authentication process is to verify that you are who you say you are in the first step. This is achieved by providing additional information which should be kept private and secret for security purposes. However, this private information does not have to be a unique value within the system. So in the example I just gave whereby you provide your identity in the form of a username to your AWS account, which will be a unique value, the next step would be to verify that identity by providing a password.

Putting AWS and the cloud to one side for a moment, usernames and passwords are not the only forms of authentication for an identity and verification process. In our everyday lives, we are presented with multiple forms of authentication methods. For example, credit and debit cards and pin numbers. So, when we use these to pay for something we authenticate to our banks. In this process we first identify ourselves by providing the credit card details with our personal information on it and then verify this identification by entering a private, secret pin number. This combination then allows us to authenticate to our banks. Authentication is not just for verifying human access to systems. Authentication takes place by systems that require access to other systems. For example, one AWS service that requires access to another to perform a function. In this instance, the same authentication principles and process is followed. Identity first, and then verification of that identity.

Now that we have a clear definition of authentication, let's take a look at authorization and see how authentication and authorization differ from each other. 

Authorization only takes place once an identity has been authenticated, so there is a clear order in which these two operate. Authentication takes place before the correct level of authorization can be attained. Authorization is the process in which a system you have authenticated to establishes what you can access and at what level.

So here, we are really looking at your access privileges and permissions. Staying with an AWS example, we have authenticated ourselves by providing the correct identity and password. Now AWS security features, and in this case, AWS IAM, identity and access management service, defines the level of authorized access assigned to that identity within the AWS account. 

Each identity can have a different level of authorized permissions associated with it. It's these permissions that determine what that identity can then access.

There is a clear distinction between authentication and authorization. Authentication identifies and verifies who you are. Authorization determines what an identity can access within a system once it has authenticated to it.