Understanding Access Control

Having a solid understanding of how AWS manages and implements access control for your AWS resources is essential if you want to pass the exam. Security features heavily in the exam; it's expected that you will be able to determine the best methods of access, and will also have the ability to define and recommend different access control methods, depending on a specific set of scenario requirements.

In this chapter, we will look at a range of different access control methods, with a special focus on the Identity and Access Management (IAM) service. We will also explain the differences between authorization and authentication, which can sometimes be misconstrued as the same principle, even though the two are very different mechanisms.

In this chapter, we will cover the following topics:

• Authentication, authorization, and access control
• Authentication...

Technical requirements

In this chapter, it will be helpful if you have basic knowledge and awareness of the IAM service.

Authentication, authorization, and access control

Before I focus on the different methods of access control and how access control is managed, I want to step back and explain how access is actually granted to a resource—how you, a service, or an application (essentially, any identity), gain the access and permission. I will also explain the access control methods used to carry out the actions that are required.

Authentication

At a high level, when an identity has to gain access to a resource or an environment (for example, a user logging in to an AWS account), the user has to identify itself in the form of a username, and then verify that they are who they say they are, which is normally confirmed in the form of a password...

Authenticating via access control methods

AWS offers the ability to access resources through a wide range of access control mechanisms, with an array of authentication methods. In this section, I want to cover some of them (that you will need to know about for the exam) in greater detail.

Usernames and passwords

I already mentioned IAM usernames and passwords, which are used to log in to your AWS account. These usernames are created by an administrator of IAM; at the same time, they will issue you with a password. Depending on how the administrator configured your account, you may be required to change your password upon the first successful authentication to AWS.

If no password policy has been configured, passwords for accounts...

IAM authorization

To understand authorization within IAM, you will have to look at the different components within the service, as follows:

• Users
• Groups
• Roles
• Identity-based policies

Users

Users are simply IAM objects that reflect the unique identity of someone that requires access to your AWS resources, and they are used as a part of the authentication process, as discussed earlier. The user object can have an associated password, which can be used in conjunction with MFA. Permission policies can be assigned to a specific user, authorizing them to gain access to services and resources; however, this is not considered a best practice. Instead, policies should be assigned to groups.

...

Summary

This chapter has focused on some of the key authentication, authorization, and access control mechanisms that are used when controlling access to your resources. Understanding the access control process and how to implement specific controls is a must for all security architects and engineers. AWS provides solid security mechanisms, with the ability to enforce stringent access security controls, but it's down to us, the users of AWS, to implement and architect those policies.

Before implementing an access control strategy, you must have an awareness of all of the available options, to determine the best course of action for your organization and environment.

Further reading

• Security Pillar AWS Well-Architected Framework: https://d1.awsstatic.com/whitepapers/architecture/AWS-Security-Pillar.pdf
• AWS IAM FAQs: https://aws.amazon.com/iam/faqs/
• IAM JSON Policy Conditions: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html