Sangam Biradar for collabnixcommunity

Posted on Dec 22, 2020 • Originally published at xcloudlabs.kubedaily.com

Nitty-Gritty of AWS IAM

#aws

Identity and Access Management (IAM)

● The key features of IAM:

Shared Access to your Account
Granular Permissions
Secure Access to AWS Resources
Identity Federation
Identity Information for Assurance
Payment Card Industry (PCI) Data Security Standard (DSS) Compliance
Password Policy
Multi Factor Authentication (MFA)

● Shared access to your AWS account

Grant permission to users to access and use resources in your AWS account without sharing your password.

● Granular Permissions

Granular permissions allow different permissions to various users to manage their access to AWS, such as:

• User access to specific services

• Specific permissions for actions

• Specific access to resources

Secure Access

Securely allocate credentials that applications on EC2 instances require to access other AWS resources.

Identity Federation

● Allows users with external accounts to get temporary access to AWS resources

Identity Information

● Log, monitor, and track what users are doing with your AWS resources.

PCI DSS Compliance

● Payment Card Industry (PCI) and Data Security Standard (DSS) compliant

Multi-Factor Authentication

● Two-Factor Authorization for users and resources to ensure absolute security using MFA devices

Password Policy

● IAM allows you to define password strength and rotation policies.

IAM Policies

● A document that defines one or more permissions

● Attached to users, groups, and roles

● Written in JavaScript Object Notation (JSON)

● Selected from a pre-defined AWS list of policies, or you can create your own policy

## AWS Policies
● AWS has many predefined policies which allow you to define granular access to AWS resources.

● There are around 200 predefined policies available for you to choose from.

AdministratorAccess Policy

● AdministratorAccess policy provides full access to AWS services and resources.

AmazonEC2FullAccess Policy

● AmazonEC2FullAccess policy provides AWS Directory Service user or groups full access to the Amazon EC2 services and resources

AmazonS3ReadOnlyAccess Policy

● AmazonS3ReadOnlyAccess policy provides read-only access to all buckets using the AWS Management Console

JSON

● AWS policies are written using JavaScript Object Notation (JSON).

{
  "Version": "2012-10-17",
  "Statement": {
    "Effect": "Allow",
    "Action": "s3:listbucket",
    "Resource": "arn:aws:s3:::example_s3_bucket"
  }
}

Policy-wide information:

Version–Date this policy was created

One or more individual statements:

Effect–Allow permission

Action– 3 list bucket

Resource–Name of the S3 bucket

## IAM Users
Users are defined as the people or systems that use your AWS resources.

## Security Credentials
AWS provides numerous ways to provide secure user access to your AWS resources:

Key pairs:

• They consist of a public and private key

• A private key is used to create a digital signature

• AWS uses the corresponding public key to validate the signature

Email address and password

• They are created when you sign up to use AWS

• They are used to sign in to AWS web pages

IAM user name and password

• They allow multiple individuals or applications access to your AWS account

• Individuals use their user names and passwords to sign in

Multi-Factor Authentication (MFA)

• With AWS MFA enabled, users are prompted for a user name and password and for an authentication code from an MFA device

Access keys

• They consist of an access key and a secret access key

• They use access keys to sign programmatic requests

## IAM Groups
● AWS defines a group as a collection of users that inherit the same set of permissions.

## IAM Roles

IAM Roles are:

• Very similar to users

• Not password protected and do not require access keys

• AWS identities with permission policies that determine the access available to the identities

• Assumed by anyone who requires them

Create Individual IAM Users

• The benefits of creating individual IAM users:

• Control permissions at an individual level

• No shared accounts

• Unique credentials for everyone

• Easier to rotate credentials

• Easier to identify security breaches

Grant Least Privilege

When creating IAM policies, granting ”least privilege,” means that:

• You only grant required permissions

• It's more secure to start with minimum permissions

• It’s easier to grant permissions than revoke them

• You protect your assets

## Manage Permissions with Groups
Use permissions with groups to minimize the workload

Easy to assign new permissions

• It is easier to assign a new permission to a group than to assign it to many individual users.

Simple to reassign permissions

• It is simpler to reassign permissions if a user has a change in responsibilities.

Restrict Access with Further Conditions

• Use additional conditions such as MFA and Security Groups to ensure only the intended users get access.

## Monitor Activity in your AWS Account
AWS has several features to log user actions.

• Logs

• AWS Cloudtrail

Create a Strong Password Policy

• Ensure that all your users have strong passwords and they rotate their passwords regularly.

Use Roles for Applications that run on EC2

• IAM Roles remove the need for your developers to store or pass credentials to AWS EC2.

## Reduce or Remove Unnecessary Credentials
• To reduce the potential for misuse, run a credential report to identify users that are no longer in use and can be removed.

AWS Security Token Service (STS)

• It is a web service that enables you to request temporary, limited-privilege credentials for AWS Identity and Access Management users that you authenticate.

STS: Things To Remember

• Develop an Identity Broker to communicate with LDAP and AWS STS

• Identity Broker always authenticates with LDAP first and then AWS STS

• Application gets temporary access to AWS resources

DEV Community