DEV Community

Aayush Bhadana
Aayush Bhadana

Posted on

AWS IAM Security Best Practices: Enforcing Least Privilege via CLI

#aws #security #cloud #devops

Identity and Access Management (IAM) is the backbone of AWS security. However, misconfigured IAM policies often grant excessive permissions, leading to potential data breaches and unauthorized resource access.
Adhering to the Principle of Least Privilege (PoLP) ensures that users, roles, and services only possess the exact permissions required to perform their tasks. In this guide, we will audit and enforce basic IAM security hardening using the AWS CLI.
Prerequisites
*AWS CLI installed and authenticated with administrative privileges.
*Basic understanding of JSON policy syntax.

Step 1: Enforcing Strong Password Policies for IAM Users

If your organization uses IAM users alongside AWS SSO, enforcing a strict password policy across the account is mandatory.
Run the following command to enforce minimum password length, symbol requirements, and password expiration:

aws iam update-account-password-policy --minimum-password-length 14 --require-symbols --require-numbers --require-uppercase-characters --require-lowercase-characters --allow-users-to-change-password --max-password-age 90 --password-reuse-prevention 5
Enter fullscreen mode Exit fullscreen mode

To verify the updated account policy:

aws iam get-account-password-policy
Enter fullscreen mode Exit fullscreen mode

Step 2: Auditing Unused Credentials and Access Keys

Stale access keys are a major vulnerability. AWS allows you to generate a Credential Report to audit inactive access keys and MFA status across all users.
Generate the report:

aws iam generate-credential-report
Enter fullscreen mode Exit fullscreen mode

Fetch and decode the generated CSV report using standard Linux CLI tools:

aws iam get-credential-report --query 'Content' --output text | base64 -d
Enter fullscreen mode Exit fullscreen mode

Review the output to identify users who haven't logged in recently or lack Multi-Factor Authentication (MFA).

Step 3: Deactivating and Deleting Unused Access Keys

Once an inactive access key is identified, deactivate it immediately before permanent deletion.

aws iam update-access-key --user-name dev-user-01 --access-key-id AKIAIOSFODNN7EXAMPLE --status Inactive
Enter fullscreen mode Exit fullscreen mode

Delete the access key after verifying no services break:

aws iam delete-access-key --user-name dev-user-01 --access-key-id AKIAIOSFODNN7EXAMPLE
Enter fullscreen mode Exit fullscreen mode

Summary

Securing AWS IAM is a continuous process. By regularly auditing credential reports, enforcing strong password rules, and removing stale access keys via the AWS CLI, you significantly shrink your cloud attack surface.

Top comments (0)