AWS - Security and Identity

AWS - Security and Identity

  1. Identity Access Management (IAM) used to manage user, groups, permission, etc.
  2. Inspector is an agent on VM to monitor security and reporting.
  3. Certificate Manager managing SSL certificate.
  4. Directory service for Active directory service and other directory service.
  5. Web application firewall for application level protection.
  6. Artifacts list of access-controlled documents

1 - IAM

  1. It is used to manage users, permission and level of access to AWS console.
  2. IAM console to manage user account access.
  3. Identity federation: Linking to users multiple accounts like Facebook, Twitter, AD service etc.
  4. Multifactor authentication[MFA].
  5. Supports temporary access for users and devices.
  6. Custom password policy.
  7. Integrates other AWS services.
  8. Support PCI DSS[The Payment Card Industry Data Security Standard (PCI DSS) is an information security standard for organisations that handle branded credit cards from the major card schemes].
  9. IAM is not region specific unlike AWS services.
  10. Root account is email address that is used to sign up AWS.
  11. Login as with account gives root level access.

1.1 - MFA

  1. To make more secure authentication.
  2. Is an extra step in addition to username and password.
  3. MFA Flow: Users sign in to AWS, Enter username and password, In addition enter registered AWS MFA device code(like OTP authentication).
  4. Above setting can be done for AWS account and IAM users created under account.
  5. It can be also used to control access to AWS service API's.
  6. To activate MFA, click Manage MFA and choose between virtual or hardware MFA device option.
  7. Virtual MFA devices: Smartphone, PC and similar supported devices. Use your existing smartphone or tablet running any application that supports the open TOTP[Time-Based One-Time Password Algorithm] standard. Google authenticator app from playStore can be downloaded and follow the instruction as provided in registration process.
  8. Hardware MFA devices: Purchase supported devices. During registration process steps provided. 

1.2 - Individual IAM user

  1. Click on manage user, then choose add user. Enter user name.
  2. Choose AWS access type(can one or both): 
    • Programmatic access - Enables an access key ID and secret access key for the AWS API, CLI, SDK, and other development tools.
    • AWS Management Console access - Enables a password that allows users to sign-in to the AWS Management Console.
      3. Next password creation for user. We get option as
    • Autogenerated password OR
    • Custom password       
      4. For Password reset
    • Users must create a new password at next sign-in
    • Users automatically get the IAMUserChangePassword policy[JSON script] to allow them to change their own password.     
     5. Next is set permissions for created user, options we get 
    • Add user to group[if exists]
    • Copy existing user permissions[simply search and assign]
    • Attach existing policy directly[search and assign]
      6. New user once created generates Username, Access key ID, Secret access key, Password.                     Username and Password for console login. Secret access key and Access key ID for 
           login to AWS services programmatically.
      7. Another option provided is to email the credentials to user through email and download 
          it as csv file.
      8. Message to note: This is the last time these credentials will be available to download. 
          However, you can create new credentials at any time.

1.3 - Creating group     

  1. Creating a new group, start with group name and then choose policy. 
  2. Can create new policy using JSON.
  3. Assign user under groups.

1.4 - Roles    

  1. IAM roles are a secure way to grant permissions to entities that you trust. Examples of entities include the following:
    • IAM user in another account
    • Application code running on an EC2 instance that needs to perform actions on AWS resources
    • An AWS service that needs to act on resources in your account to provide its features
    • Users from a corporate directory who use identity federation with SAML
    • IAM roles issue keys that are valid for short durations, making them a more secure way to grant access.
       2. Trusted entity are 
    • AWS service
    • Another AWS account
    • Web identity
    • Saml 2.0 federation
       3. Create new role, Choose entity and then choose permissions for entity. Go next and give role
           name, description and create.


















Comments

Post a Comment