Access Management

The previous chapters focused more on what gets protected. This chapter begins the discussion on the who, which is not who gets protected but rather what permissions users and groups are allocated. Access management starts with segmenting users into groups so that they can be managed more effectively.

This chapter will help you with confidently implementing and managing access controls across various authentication mechanisms and will ensure you have a thorough understanding of all principles of permission-based access policies. You will also learn about some of the specific services and features in place that are designed to enrich and enhance the access control method selected.

In this chapter, you will learn how identities in the AWS Identity and Access Management system are authenticated and authorized. This allows the identities to perform their tasks in an appropriate manner that then becomes auditable.

The following main topics will be covered in this...

Technical Requirements

You will need access to the AWS Management Console with an active account and AWS CLI access. You will also need access to a device on which you can install the Google Authenticator application.

Understanding the Identity and Access Management (IAM) Service

AWS IAM is a service provided by AWS that helps you control who can access your AWS resources and what they can do with them. It allows you to manage user accounts, set up permissions, and ensure the security of your AWS infrastructure.

Suppose you want to create a new user for your team member named Alice. You can do this quickly and easily with the AWS CLI using the following command:

aws iam create-user --user-name Alice

After your user Alice has been created, you would need to assign her permissions based on her job role and function. In this case, you could give Alice access to the Amazon S3 service, which she could use to put and retrieve files:

aws iam attach-user-policy --user-name Alice --policy-arn arn:aws:iam::aws:policy/AmazonS3FullAccess

After attaching the managed S3 policy to user Alice, you realize it would be better to make sure that Alice only has permission to access the specific buckets...

Security Token Service

AWS STS acts as a trusted intermediary that issues temporary security credentials to users or applications when they need to access AWS resources. These temporary credentials have a limited lifespan, typically ranging from a few minutes to a few hours. Such credentials reduce the risk of unauthorized access if credentials are compromised and also minimize the window of opportunity for attackers to exploit stolen records.

AWS STS allows you to implement the principle of least privilege, granting users or applications only the necessary permissions required for their tasks. By defining fine-grained access policies for temporary credentials, you ensure that individuals or applications only have access to the specific resources they need, thereby reducing the potential impact of any security breaches.

Further, credentials automatically expire after a defined period and require users or applications to re-authenticate and obtain new credentials for continued...

IAM Identity Center

IAM Identity Center is an AWS service that allows companies to manage the security of the sign-in process for their workforce users. It provides Single Sign-On (SSO) access to applications, multi-account permissions, and a simple web portal. With IAM Identity Center, your organization can create and manage its users’ access to all AWS accounts and applications from a central location. The service also enables users to create workforce users and groups within IAM Identity Center or synchronize them with an existing identity source, such as Microsoft Active Directory Domain Services or external IdPs such as Okta Universal Directory or Microsoft Entra ID (formerly Azure AD).

The following are the main features of IAM Identity Center:

• Multi-Account Permissions
• Workforce Identities
• Application Assignments for SAML Applications
• Identity Center-Enabled Applications
• AWS Access Portal

IAM Identity Center simplifies managing permissions...

Summary

This chapter discussed the IAM service. You saw how authentication and authorization form the basis of IAM and discovered some of the best practices for using IAM. You completed an exercise of creating a group in IAM, creating a new user, adding a policy to that user, and then adding that user to the previously created group.

You also saw how STS could be used to create temporary security credentials, which are more secure than providing long-term security credentials for both users and roles. Finally, you reviewed AWS IAM Identity Center and how it can help manage user accounts across many accounts in an AWS organization and provide consolidated access to those same users to SaaS applications outside of your AWS environment.

In Chapter 14, Working with Access Policies, you will examine the policies and constructs used in IAM policies, service control policies, and other policies.

Further Reading

For additional information on the AWS Shared Responsibility Model and the underlying foundation of AWS security, please check out the following resources:

• AWS Identity and Access Management (IAM) FAQs: https://packt.link/5lG7g
• You can now assign multiple MFA devices in IAM: https://packt.link/ySmO1
• AWS Simple Token Service API reference: https://packt.link/rKu35
• AWS IAM Identity Center FAQs: https://packt.link/1xzoF

Exam Readiness Drill – Chapter Review Questions

Apart from a solid understanding of key concepts, being able to think quickly under time pressure is a skill that will help you ace your certification exam. That is why working on these skills early on in your learning journey is key.

Chapter review questions are designed to improve your test-taking skills progressively with each chapter you learn and review your understanding of key concepts in the chapter at the same time. You’ll find these at the end of each chapter.

How To Access These Resources

To learn how to access these resources, head over to the chapter titled Chapter 21, Accessing the Online Practice Resources.

To open the Chapter Review Questions for this chapter, perform the following steps:

1. Click the link – https://packt.link/SCSC02E2_CH13

   Alternatively, you can scan the following QR code (Figure 13.11):

Figure 13.11: QR code that opens Chapter Review...