Identity and Access Management – Securing Users, Roles, and Policies

Welcome to the third chapter of our deep dive into AWS security. In this chapter, we will focus on AWS Identity and Access Management (IAM), which is the backbone of AWS security. We will embark on a journey where we will cover the foundational access control models, such as RBAC and ABAC, and their pivotal role in AWS. Transitioning from there, we will explore the vast landscape of IAM identities, shedding light on both human and non-human identities, the nuances of various credential types, and the detailed workings of IAM users, groups, roles, and externally managed identities. As we progress, IAM policies will come to the forefront, where we will discuss everything from their basic structure to advanced use cases and efficient management techniques. Toward the end, we will tackle the challenges posed by IAM in expansive, multi-account AWS deployments, emphasizing the value of centralized IAM management...

Access control models

In the realm of AWS IAM, understanding access control models is fundamental. These models provide a structured approach to defining how users (or roles) interact with resources within your AWS environment. The two most commonly used models in AWS are role-based access control (RBAC) and attribute-based access control (ABAC), but others may also be relevant, depending on your specific use case.

Access control models overview

Access control models are essentially frameworks that dictate who can access what within a system. They define how permissions are granted and how different identities (users, roles, and others) can interact with resources. The choice of an access control model can significantly impact the security posture of your AWS environment, so it is crucial to understand the different options available and their implications.

In AWS IAM, the primary access control models are RBAC and ABAC. However, there are also other models, such as discretionary...

Managing IAM identities

In AWS, managing identities is a crucial aspect of maintaining secure and efficient access to your environment. In the following subsections, we will delve deeper into the types of identities and credentials used in AWS, review IAM users, groups, and roles, and explore the concept of external identities and federations in AWS. This integration allows you to align AWS IAM with external identity systems. We will also discuss best practices for managing IAM identities.

Managing both human and non-human identities

Human identities typically represent individual users having access to your environment. These users might be system administrators, developers, or business users who need access to AWS resources. Each human user is typically represented in AWS IAM as an IAM user. IAM users can be grouped into IAM groups for easier management. Each IAM user can be assigned individual security credentials, such as passwords and access keys.

Non-human identities...

IAM in multi-account deployments

Managing IAM in a multi-account environment is a complex endeavor, especially when dealing with large-scale deployments. AWS provides a suite of tools to streamline this process, but understanding how they fit in the picture is crucial. In this section, we will delve deeper into the challenges, solutions, and best practices for managing IAM in such environments.

Challenges with managing large-scale IAM deployments

IAM management in expansive environments brings forth a myriad of challenges:

• Scalability: As organizations grow, so does the need for more AWS resources and accounts. This ensures that IAM policies scale effectively without becoming unwieldy is a challenge.
• Granularity versus manageability: As the number of IAM identities grows, administrators face the dilemma of granularity versus manageability. While it is tempting to create highly specific permissions for each identity, this can lead to an administrative nightmare.
...

Summary

In this chapter, we navigated the multifaceted world of AWS IAM. Starting with a thorough understanding of access control models, such as RBAC and ABAC, we shifted gears to managing IAM identities, covering the spectrum from human and non-human identities and credential types to the intricacies of IAM users, groups, roles, and externally managed identities. Then, IAM policies took center stage, with discussions ranging from basic concepts to advanced use cases and policy management techniques. This chapter wrapped up by addressing the challenges of IAM in large-scale environments, the merits of centralized IAM management, and the importance of automation in today’s DevOps-driven landscape.

As we transition to the next chapter, we will focus on data protection in AWS, diving into encryption methods, key management techniques, and best practices for data storage.

Questions

Answer the following questions to test your knowledge of this chapter:

1. Which two access control models are primarily discussed in the context of AWS IAM, and how do they fundamentally differ in their approach to permissions?
2. What is the primary purpose of SCPs in AWS Organizations, and how do they interact with local IAM policies?
3. In a multi-account AWS setup, what mechanism allows IAM identities in one account to access resources in another account without sharing access keys, and what are the benefits associated with it?
4. In the era of DevOps, why is automating IAM implementation considered crucial, especially in large-scale and multi-account AWS environments?

Answers

Here are the answers to this chapter’s questions:

1. The two primary access control models are RBAC and ABAC. RBAC regulates access based on predefined roles assigned to users, where each role has a specific set of permissions. In contrast, ABAC uses attributes (associated with users, resources, or the environment) as building blocks in access control decisions, allowing for more granular and dynamic permissions.
2. SCPs in AWS Organizations set permission restrictions for all accounts in an organization. They define the maximum permissions that IAM identities can have. SCPs take precedence over any locally defined IAM policies, meaning if an account has a permissive policy, the SCPs can still restrict it, ensuring centralized control.
3. Role-based cross-account access allows IAM identities in one AWS account to access resources in another account without sharing access keys. The trusting account specifies which external accounts can access its resources, while...

Further reading

To learn more about the topics that were covered in this chapter, take a look at the following resources:

• Best practice rules for AWS Identity and Access Management (IAM), by TrendMicro: https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/IAM/
• An introduction to AWS IAM best practices, by Stephen J. Bigelow (2021): https://www.techtarget.com/searchcloudcomputing/tip/An-introduction-to-AWS-IAM-best-practices
• 12 AWS IAM Security Best Practices, by Tobias Schmidt (2023): https://spacelift.io/blog/aws-iam-best-practices
• AWS re:Post - How can I require MFA authentication for IAM users that use the AWS CLI: https://repost.aws/knowledge-center/mfa-iam-user-aws-cli