IAM on AWS

AWS IAM (Identity and Access Management) is a service provided by Amazon Web Services that enables users to manage access and permissions for AWS resources. With IAM, users can create and manage AWS users, groups, and roles, and can assign granular permissions to each of these entities to control what actions they can perform on AWS resources.

IAM allows you to manage access to AWS resources centrally, ensuring that only authorized users and services have access to resources. This is achieved by assigning permissions based on policies that specify what actions a user, group, or role can perform on a specific AWS resource. You can also use IAM to control access to specific actions within a service, such as only allowing certain users to create or delete specific EC2 instances.

IAM also supports multi-factor authentication (MFA), which provides an additional layer of security to the login process by requiring users to enter a second form of authentication, such as a code from a mobile device or a biometric factor.

IAM users groups policies principle of least privilege

IAM users, groups, and policies in AWS adhere to the principle of least privilege, which means that each user, group, or role is granted only the permissions necessary to perform its intended actions, and no more.

This principle ensures that users and services are not granted excessive permissions that could be exploited by attackers or inadvertently result in unintended actions. By following the principle of least privilege, you can minimize the risk of unauthorized access to your AWS resources, as well as accidental or malicious actions that could cause data breaches or other security incidents.

IAM policies are written in JSON format and define the permissions granted to users, groups, or roles. These policies can be attached to individual users, groups, or roles, or to specific AWS resources, and they can be customized to restrict access to specific actions within a service or resource.

When creating IAM policies, it is important to carefully evaluate the permissions that are required for each user, group, or role, and to ensure that they are only granted the minimum necessary permissions to perform their tasks. This requires a thorough understanding of the specific resources and services that are being used, as well as the roles and responsibilities of each user or service.

How to create a users, assign group, assign tags in AWS

Here are the general steps to create a new user, assign them to a group, and assign tags in AWS:

1. Sign in to your AWS account using your root account credentials.
2. Open the IAM console by clicking on the “Services” menu, selecting “IAM” under “Security, Identity, & Compliance”.
3. In the left navigation pane, select “Users” and then click on the “Add user” button.
4. Enter a name for the user and select the “Programmatic access” and/or “AWS Management Console access” checkboxes to grant access to the AWS Management Console and/or to access AWS services programmatically using an access key and secret access key.
5. Click on the “Next: Permissions” button.
6. Select “Add user to group” and then click on the “Create group” button.
7. Enter a name for the group, and then click on the “Create group” button.
8. In the list of groups, select the group you just created, and then click on the “Next: Tags” button.
9. To add tags to the user, select “Add tag”, enter the tag key and tag value, and then click on the “Next: Review” button.
10. Review the user’s settings and click on the “Create user” button.

After you create the user, you can provide the access key and secret access key to the user for programmatic access to AWS services, or provide them with the URL to access the AWS Management Console.

You can then assign the user to other groups as needed, and assign additional permissions to the user using IAM policies. You can also modify or delete the user, change their password, and update their settings as needed using the IAM console.

IAM policy inheritance

IAM policies in AWS can inherit permissions from other policies in a hierarchical manner. This means that you can define a policy at a higher level and have other policies inherit the permissions from that policy. This can simplify policy management by reducing the need to duplicate permissions across multiple policies.

The policy inheritance hierarchy in AWS IAM works as follows:

1. The root account is at the top of the hierarchy and has full permissions across all AWS services and resources.
2. The next level is the AWS account level, where account administrators can define policies that apply to all users and resources in the account.
3. The next level is the IAM group level, where group administrators can define policies that apply to all users in the group.
4. The lowest level is the individual user level, where users can have individual policies that apply only to them.

When a user, group, or resource requests access to an AWS service, the IAM service checks all of the policies that apply to the user, group, or resource, and then combines the permissions from each policy to determine the final set of permissions that are granted. Policies at higher levels of the hierarchy are evaluated first, and their permissions are inherited by policies at lower levels.

For example, if a user is a member of two groups, each of which has a policy that grants access to a particular S3 bucket, the user’s final permissions for that bucket are the union of the permissions granted by both policies. If the user also has an individual policy that denies access to the same bucket, the final permission for the bucket is the intersection of the permissions granted by the group policies and the permission denied by the individual policy.

Explain JSON for IAM

JSON (JavaScript Object Notation) is a lightweight data-interchange format used by AWS IAM (Identity and Access Management) to define policies for users, groups, and roles. IAM policies are written in JSON format and specify the permissions that are granted or denied for specific AWS resources or actions.

JSON is a text format that is easy to read and write, and is widely supported by programming languages and applications. JSON is comprised of key-value pairs, where the key is a string and the value can be a string, number, boolean, array, or object. JSON objects are enclosed in curly braces { } and consist of a set of key-value pairs separated by commas. JSON arrays are enclosed in square brackets [ ] and consist of a list of values separated by commas.

Here is an example of a simple IAM policy in JSON format:

jsonCopy code{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::example-bucket/*"
    }
  ]
}

This policy allows users with this policy attached to perform the s3:GetObject and s3:PutObject actions on all objects in the example-bucket S3 bucket. The arn:aws:s3:::example-bucket/* portion specifies the resource that this policy applies to.

The policy contains a Version field that specifies the IAM policy language version that the policy uses. The Statement field contains an array of one or more statements, where each statement defines a set of permissions for a specific AWS resource or action.

Each statement includes an Effect field that specifies whether the permissions are allowed or denied, an Action field that specifies the AWS action that is allowed or denied, and a Resource field that specifies the AWS resource that the action can be performed on.

JSON policies can also include other fields, such as Condition fields that specify additional conditions that must be met in order for the policy to be applied.

How to setup AWS IAM password policy

To set up a password policy for AWS IAM, follow these steps:

1. Sign in to the AWS Management Console and open the IAM console.
2. In the left navigation pane, click on “Account settings”.
3. In the “Password policy” section, click on “Edit”.
4. Choose the password policy settings that you want to apply. The following are some of the key settings that you can configure:
   • Minimum password length: Specify the minimum number of characters that a password must contain.
   • Require uppercase letters: Specify whether passwords must contain at least one uppercase letter.
   • Require lowercase letters: Specify whether passwords must contain at least one lowercase letter.
   • Require numbers: Specify whether passwords must contain at least one number.
   • Require non-alphanumeric characters: Specify whether passwords must contain at least one non-alphanumeric character.
   • Password expiration: Specify how often users must change their passwords.
   • Password reuse prevention: Specify the number of previous passwords that users cannot reuse.
5. Click on “Save changes” to apply the password policy.

Note that the password policy applies to all users in your AWS account. Once the policy is applied, any new passwords or password changes must meet the requirements that you have specified.

Additionally, you can enable multi-factor authentication (MFA) for AWS IAM users. MFA adds an extra layer of security by requiring users to provide two forms of authentication: their password and a security token generated by a physical or virtual device. To enable MFA for IAM users, navigate to the “Users” section in the IAM console, select the user, and then click on the “Security credentials” tab. From there, you can enable MFA and configure the device that users will use to generate the security token.

What are MFA device options in AWS

AWS offers several MFA device options to generate the required security token for IAM users. These options include:

1. Virtual MFA device: A virtual MFA device is a software application that generates time-based, one-time passwords (TOTP) on a mobile device or computer. AWS provides a virtual MFA app that can be installed on iOS or Android devices.
2. Hardware MFA device: A hardware MFA device is a physical device that generates TOTP codes. AWS supports a variety of hardware MFA devices, including YubiKey and Gemalto.
3. SMS MFA: AWS allows you to configure SMS as an MFA device. When a user logs in, AWS sends a one-time code to the user’s phone via SMS. The user must enter the code to complete the login process.
4. Voice call MFA: AWS also allows you to configure a voice call as an MFA device. When a user logs in, AWS calls the user’s phone and prompts the user to enter a PIN number.

Note that for security reasons, AWS recommends using a hardware or virtual MFA device rather than SMS or voice call MFA. Hardware MFA devices are considered to be the most secure option because they are not vulnerable to phishing attacks or malware that may be present on a computer or mobile device.

Conclusion

AWS IAM is an essential service for managing access and permissions to AWS resources and plays a critical role in securing and controlling access to your AWS environment. Principle of least privilege is a fundamental aspect of IAM security in AWS, and is essential for maintaining the security and integrity of your AWS environment. IAM policy inheritance can simplify policy management and reduce the risk of errors or inconsistencies in policy definitions. However, it is important to carefully design and test policies to ensure that they provide the intended level of access to AWS resources.