• Secure access control to Authenticate and Authorize users with our accounts
• Login with Root user to create account credentials and create another aws account
• Never use root account to launch any aws resources as root user is a powerful user

Authentication - who are you?

• Verifying the identity of the user

Authorization - what you can do?

• Specify Access control policies

AWS Identity Types

• To control access to resources and services

Below users can be provided permissions to access aws resources

1. AWS Root Users - with unlimited privileges, it has Total access, login using email and password
2. IAM Users - Native to aws, Created, stored and managed within aws

• It uses Access key and password for accessing the resources
• Newly created user has no permissions by default, it has to configured to accordingly
• User can have one aws account, can access across regions
• Service Accounts - used to perform actions on aws resources on behalf of other users/services

3. Federated Users - Users Authenticated via external providers (Active Directory, Facebook, Google), these users not stored in aws database, managed by external providers
4. IAM User Groups - collection of IAM users, governed by policies
5. IAM Roles- An IAM role is an identity that grants permissions to users, it has permissions to enable users what action can they perform on aws resources
6. IAM Temporary credentials - short lived & limited privileged credentials, it lives for limited time and expires automatically after

• Logging with AWS CloudTrail
  • Record of actions - to capture actions performed on the console or api calls for IAM

IAM Policies and Permissions

In Order to manage the permissions - Policies can be created and assigned to AWS Identities

• Explicit Deny - anything denied everything denied
• Deny By Default
  • AWS Resources denies permissions unless explicitly allowed permissions
• Each part of request must be granted

IAM Policy Objects

• It contains Information about Who (the principal), Which Resource, What Conditions
• Policy Attached to IAM identity or AWS Resource
• Policy is evaluated whenever request is made
• Policy changes take effect immediately
• Policy objects are stored as JSON documents

IAM Access Permissions

• Permissions are required to be enabled between services (service to service access)

Policy Types

• Identity Based Policy

  • These policies directly attached to IAM user groups or roles to specify the actions allowed to perform

• Resource based Policy

  • Specified to resources to specify allowed actions

• Permissions boundaries

  • Defines maximum permissions to user groups or roles or other policies

• Service Control Policies (SCPs)

  • To define the policies at the root level of the organization

• ACL

  • To specify permissions for Amazon S3 objects not for any other aws services

• Session Policies - to specify permissions aws session tokens created

• Policy can be versioned

IAM Security

• 3 Pillars of Security

  • Availability
  • Confidentiality
  • Integrity

• Resilience - Regions & Availability Zones Isolated from each other - Provides Availability, Fault Tolerance and Scalability

• Infrastructure security

• Configuration & Vulnerability analysis - AWS has procedures and ways to check the vulnerabilities

IAM Logging & Monitoring

IAM Compliance Program

IAM Security Best Practices

• Secure Root User Keys

  • Enable MFA
  • Do not use for any regular purpose, use this only on emergency purposes
  • Store the keys securely
  • Regularly Monitor the use of root account for any suspicious activity

• Create Individual users - with the minimum required permissions to perform their tasks

• Create user groups

• Enforce least privileges

• Use AWS managed policies - created and managed by aws security experts, regularly updated for security

• Validate policies regularly to check if it meets the requirements

• Use Customer managed policies

  • to meet the customer specific security requirements

• Secure the access keys

• Rotate the credentials periodically

• Delete unused credentials

• Monitor regularly

IAM Access Analyser

• Used to generate and validate IAM policies

Amazon Cognito User Pools

• It is a fully managed user authentication and identity management service
• It is the user directory in cognito
• Users can sign on to web and mobile apps using cognito, it allows Social Networks and SAML Identity Providers
• SDK APIs can be used to access profiles, integrate users into apps
• To signup and signin Use amazon cognito UI or custom web ui
  • Using Amazon Cognito hosted UI - provides default construction of the signup/sign in flow, this flow also handles and validates the response token received from the IDP
• Custom workflows can be triggered when a user signs in, using the lambda fns
• Amazon Pinpoint Analytics - to send the user notifications, emails and perform other engagement, marketing campaign

Working with User Pool

• AWS account is required for the new user, then onboard onto user pool
• the new user belongs to the aws region that he was assigned to, but user data can be shared to other region if required
• Cognito Generates - Access Token, Refresh Token (long living between 1 hr to 10 yrs)
• During Signin - User can create Social Sign-in or create SAML identity provider sign-in option
• As a result of the authentication process, tokens are returned (ID Token, Access Token, Refresh Token)
  • ID Token - contains identity of the authenticated user, user claims such as Name, Email
  • Access Token - is issued to grant access the resource
  • Refresh Token - is a long lived token to refresh the access token when expired

Amazon Cognito Identity Pools (Federated Identities)

AWS Directory Service

• Integrates with Microsoft Active Directory (AD) with the aws services
• AD or LDAP apps in the cloud

• There are constraints in integrating the Managed Ms AD,

• the account should be in the same region in order for the integration to be seamless

• AD should be created within the VPC with atleast 2 subnets in place

• Variants

  • Standard Edition - upto 5000 AD objects
  • Enterprise Edition - upto half million AD objects

• Directory is schema based structure keep the objects in a hierarchical structure

AD Schema

• AD Objects Schema can be considered similar to Tables and columns in a table
• Classes - Table
• Attributes - Columns in a table
• Object Identifier (OID) - uniqueness of attribute
• Schema is important to keep the integrity and interoperability

Amazon Cloud Director

• Directory based aws store, it is not directory replacement for Ms AD
• It is designed to support multi-tenancy and automatic scaling (support hundreds of millions of objects)
• Supports Directory objects organized into multilevel hierarchy

Directory Objects

https://docs.aws.amazon.com/clouddirectory/latest/developerguide/directory_objects.html

https://docs.aws.amazon.com/clouddirectory/latest/developerguide/directory_objects_links.html

---

AWS Resource Access Manager (RAM)

• Allows Securely share the aws resources with resource, users, roles

---

Resource Groups

• It is a collection aws resources and All resources should be in same aws region
• All resources in the group should match query criteria (Specification)

Resource Group Query Types

• Tag Based Query
  • Specify resources based on tags, key-value pair
• CloudFormation based Query
  • Stack-based query, specify resources based on the stacks (based on single cloudformation stack, not multiple cloudformation stacks)

Defining Tags

• Word or phrases
• To identify and organize resources
• key and optional value
• Limitation upto 50 user tags
• support read-only tags (system tags, cannot be modified or deleted by user)

AWS Single Sign-On (IAM Identity Center)

• Centralized portal to managing sso users, aws accounts and third part apps
• Easier to access and permissions management

Working with AWS SSO

• It uses SAML federation

  • Security assertion markup language - a xml based mechanism to exchange information about user identity
  • SAML 2.0 is the industry standard

• Configuration

  • configure the permission sets

Audit Manager

Which conditions must be met in order to use resource groups?

What are the main roles in the Audit Manager process?

Which are AWS policy types?

In the process of creating a directory, AWS Managed AD creates an administrator account with which name? ans: Admin

Which statements accurately describe how AWS Resource Access Manager (RAM) can be used when managing accounts under an AWS Organization?

Which is a valid AWS managed policy that may be applied to a group of development users?

In Amazon Cloud Directory, which components together comprise a schema?

Which types of access control are supported by Cognito identity pools?

Which statements accurately describe AWS Managed Policies?

Which token returned by Cognito User Pool is a long-lived token that may be used to obtain a new access token when the current one expires? Refresh token

Which statements accurately describe AWS Single Sign-On (SSO)?

Which service are IAM temporary credentials generated by?

Which entity is capable of making requests of AWS resources?

---

References

• How SAML Authentication Works
• LDAP vs. Active Directory: Everything You Need to Know