Identity and Access Management - AWS

Identity and Access Management is abbreviated as IAM, is a global eventually consistent service,         

which securely manages,

Accounts - The first entity that is created to provide access to the AWS resources.

User - An entity that you create in AWS to represent the person or application that uses it to interact with AWS. The user created during the AWS account creation is called root user. Each IAM user is associated with one and only one AWS account, because users are defined within your AWS account. An IAM user with administrator permissions is not the same as the AWS account root user.

One Physical User = One User Account

AWS user credential types are classified into,

1. AWS Management Console Access - Password
2. Programmatic Access - Access Key

AWS strongly recommends not to use root account for day to day tasks.

User Groups - group of users, groups can contain only users and cannot contain another group. Users within the group will inherit the group permissions, thus providing a cleaner way of managing permission for users. All users need not belong to a group and same users can be in many groups.

Policies - The permission for users and groups are provided through IAM policies, is a JSON document in the below structure.

{
    "Version": "2012-10-17",
    "id": "Optional-Policy-Identifier",
    "Statement": [
        {
           "Sid": "Optional-Statement-Identifier",
           "Effect": "Allow/Deny",
           "Principal": "*",
           "Action": "*",
           "Resource": "*",
           "Condition":{
                "{{condition}}":{
                    "key":"value"
                 }
           }
        }
    ]
}

Policy file consists of,

• version - Policy language version
• id - Policy identifier, Optional field
• Statement - Policy statements

Statement consists of

• Sid - Statement Identifier, Optional field
• Effect - Denotes whether the action is Allowed or Denied.
• Action - Indicates the actions which are allowed or denied on the AWS resource
• Resource - Represents the policy is applied for resources created in AWS services for which the action is allowed or denied.
• Condition - resource condition is optional, used to apply this policy on the resource matching the condition.
• Principal - specify the principal that is allowed or denied access to a resource, allowed only in resource based policies. Identity-based policies are permissions policies that you attach to IAM identities (users, groups, or roles). In those cases, the principal is implicitly the identity where the policy is attached.

Below is a sample policy,

{
  "Version": "2012-10-17",
  "Statement":[{
  "Effect":"Allow",
  "Action": [
       "ec2:AuthorizeSecurityGroupIngress",
       "ec2:AuthorizeSecurityGroupEgress",
       "ec2:RevokeSecurityGroupIngress",
       "ec2:RevokeSecurityGroupEgress"
  ],
  "Resource": "arn:aws:ec2:region:account:security-group/*",
  "Condition": {
      "StringEquals": {
          "ec2:Vpc": "arn:aws:ec2:region:account:vpc/vpc-11223"
        }
      }
    }
  ]
}

Apply least privilege principle for providing permissions to users.

Creating a policy specific to the user or role is handled through inline policy. Inline policy cannot be reused. The best practice is to create a policy and assign that to an user or group.

AWS Policy Generator can be used to generate the JSON policy document. IAM Policy Simulator is used to test policies that are attached to IAM users, user groups, or roles in your AWS account

Roles - provides permission for the aws services to access the other aws resources. Roles are similar to policies, but they are intended to be used only by the aws services.
Consider an example, where we have deployed our application in a virtual machine (ec2) and it has to write and read data from a database like dynamodb. For the application running in our ec2 instance to do this action, we have to provide a role, that allows ec2 instance to access the dynamodb.

Common Roles include,

• EC2 Instance Roles
• Lambda Function Roles
• Cloud Formation Roles

Multi Factor Authentication (MFA):

AWS recommends setting up MFA for root and other user accounts to improve the account security. 

MFA = traditional password + auto generated passcode from security device.

Types of MFA:

1. Virtual MFA Device - Authy, Google Authenticator. Supports Multiple token on the same device.
2. Universal 2nd Factor Authentication - Physical key like Yubikey. Supports multiple root and IAM users with a single key.
3. Hardware Key Fob MFA device - Gemalto (RSA Token), SurePassId for AWSGov

Other Security Aspects:

• Password policy - enforcement of length, special characters, numbers, preventing usage of last n passwords, periodic password expiry.
• Auto generated temporary passwords while creating new users, can be overridden with the custom password. 

Security Tools:

• Access Advisor - Access Advisor shows the services that this user can access and when those services were last accessed. Any unused permission granted for the user can be reviewed and revoked.
  
  
  
  
  
• Credentials Report - Report that lists all users in your account and the status of their various credentials, including passwords, access keys, and MFA devices. This is to audit the effects of credential lifecycle requirements, such as password and access key rotation. The report is generated report as often as once in every four hours. 
  Never share your IAM user credentials or access keys.

References

1. AWS Identity and Access Management Documentation