In AWS world, everything is a service; in fact more technically a web service. Even for security there is one, IAM (Identity Access Management).
IAM background
Let's assume, you manage a team (in a big company or you are a startup) and you decide to embrace your favourite cloud platform, AWS. To start with, you create an account on AWS. This is root account or root user (as called in Linux world). You want your team members to get access to AWS console and it's different services.Do you want to give them the same access as you have? Definitely NOT!
Full administrative access to all users will affect security of your systems and critical data. Root access might affect your monthly bills - what if a user starts bunch of powerful EC2 instances, although you wanted to use only S3 services of AWS. That's where the concept of users, groups, role, policies comes into picture in AWS and this all gets achieved using IAM service.
Amazon follows a shared security model - this means it's responsible for securing platform but as as customer you need to secure your data and access to a service.
Root Account gets created when you first setup your AWS account. It has complete admin access.
What is IAM ?
IAM is authentication and authorisation service of AWS. IAM allows your to control who can access AWS resources, how they can access and in what ways. As an Administrator, it gives you centralised control of your AWS account and enables you to manage users and their level of access to the AWS console.
IAM, being a core service has global scope (not specific to a region). This means your user accounts, roles will be available all across the world.
IAM Page on AWS Console
Sign-in through your root account to the AWS console. On the left top of UI, click on services and then from the list of services click IAM (comes under Security, Identity and Compliance). This takes to the IAM page of the console.
At the very top it gives sign-in link which has numeric account number in the URL. I customised the url for easy readability by replacing account number with geekrai (this blog name). Attaching below screenshot of my IAM page.
IAM Components
Above image shows the IAM page in the AWS console. It shows that there are 0 users (root user is not counted as a user), 0 groups and 0 roles. We will explore in detail all IAM components -
Users - End users of the services.
Click on the Create individual IAM users to configure users for this account. Through this you can add as many users as you want to this account. By default new users have no permission when they get created. There are two types of accesses for new users.
- Programatic Access: AWS enables an access key ID and secret access key for accessing AWS programatically (AWS API, CLI, SDK etc).
- AWS Management Console Access: This allows your users to sign-in to AWS console. Users need a password to sign-in.
You can choose either or both of above access types for a user.
Groups - A collection of user under one set of permission.
Once a user is created, (ideally) it should be part of a group like developer, administrator etc. I created a group named as developer and added user with name siddheshwar to the group. This enables you to add policies to the group.
Policies (Policy Document) - It's a document which defines one or more permissions which gets attached to the group or user.
Policy document is a key value pair in JSON format. AWS console provides list of all possible policies, you just need to select the one which is apt for your case.
AmazonEC2FullAccess
Provides full access to Amazon EC2 via the AWS Management Console.
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "ec2:*",
"Effect": "Allow",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "elasticloadbalancing:*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "cloudwatch:*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "autoscaling:*",
"Resource": "*"
}
]
}
AdministratorAccess
Provides full access to AWS services and resources
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "*",
"Resource": "*"
}
]
}
Administrator access is the same as root access. Please note that these policies can be added directly to the user, does't have always to be through Group.
Roles - Roles control responsibilities which get assigned to AWS resources.
How roles can help -
- Enable Identity federation. Allow users to log-in to AWS console through gmail, Amazon, OpenId etc.
- Enable access between your AWS account and 3rd party AWS account.
- Allow EC2 instance to call AWS services on your behalf.
Below is the screenshot of a role page.
More details about Roles, here.
IAM Best Practices
Multi Factor Authentication (MFA) For Root Account: Root account is the id password which you used to sign in to the AWS. Root account gives you unlimited access to AWS, and that's why security is quite important and AWS recommends to set up MFA. Once you set MFA, you will have to provide a MFA code as well while signing in.
Reference- https://aws.amazon.com/iam/details/mfa/
Set Password Policy: It's a good practice to set password polices- like what all characters are mandatory in password, expiry time or rotation policy.
Set Billing Alarm: You can set a threshold level on your monthly bills; if that level crosses then AWS will send an e-mail. This feature is not directly related to IAM. Amazon's cloud watch service helps in monitoring the billing.
Reference- https://aws.amazon.com/iam/details/mfa/
Set Password Policy: It's a good practice to set password polices- like what all characters are mandatory in password, expiry time or rotation policy.
Set Billing Alarm: You can set a threshold level on your monthly bills; if that level crosses then AWS will send an e-mail. This feature is not directly related to IAM. Amazon's cloud watch service helps in monitoring the billing.
---
happy learning !
