AWS Identity Services Cheat Sheet

IAM – Identity & Access Management

• securely control access to AWS services and resources
• helps create and manage user identities and grant permissions for those users to access AWS resources
• helps create groups for multiple users with similar permissions
• not appropriate for application authentication
• is Global and does not need to be migrated to a different region
• helps define Policies,
  • in JSON format
  • all permissions are implicitly denied by default
  • most restrictive policy wins
• IAM Role
  • helps grants and delegate access to users and services without the need of creating permanent credentials
  • IAM users or AWS services can assume a role to obtain temporary security credentials that can be used to make AWS API calls
  • needs Trust policy to define who and Permission policy to define what the user or service can access
  • used with Security Token Service (STS), a lightweight web service that provides temporary, limited privilege credentials for IAM users or for authenticated federated users
  • IAM role scenarios
    • Service access for e.g. EC2 to access S3 or DynamoDB
    • Cross Account access for users
      • with user within the same account
      • with user within an AWS account owned the same owner
      • with user from a Third Party AWS account with External ID for enhanced security
    • Identity Providers & Federation
      • AssumeRoleWithWebIdentity – Web Identity Federation, where the user can be authenticated using external authentication Identity providers like Amazon, Google or any OpenId IdP
      • AssumeRoleWithSAML – Identity Provider using SAML 2.0, where the user can be authenticated using on premises Active Directory, Open Ldap or any SAML 2.0 compliant IdP
      • AssumeRole (recommended) or GetFederationToken – For other Identity Providers, use Identity Broker to authenticate and provide temporary Credentials
• IAM Best Practices
  • Do not use Root account for anything other than billing
  • Create Individual IAM users
  • Use groups to assign permissions to IAM users
  • Grant least privilege
  • Use IAM roles for applications on EC2
  • Delegate using roles instead of sharing credentials
  • Rotate credentials regularly
  • Use Policy conditions for increased granularity
  • Use CloudTrail to keep a history of activity
  • Enforce a strong IAM password policy for IAM users
  • Remove all unused users and credentials

AWS Organizations

• is an account management service that enables consolidating multiple AWS accounts into an organization that can be centrally managed.
• include consolidated billing and account management capabilities that enable one to better meet the budgetary, security, and compliance needs of your business.
• As an administrator of an organization, new accounts can be created in an organization and invite existing accounts to join the organization.
• enables you to
  • Automate AWS account creation and management, and provision resources with AWS CloudFormation Stacksets.
  • Maintain a secure environment with policies and management of AWS security services
  • Govern access to AWS services, resources, and regions
  • Centrally manage policies across multiple AWS accounts
  • Audit your environment for compliance 
  • View and manage costs with consolidated billing 
  • Configure AWS services across multiple accounts 
• supports Service Control Policies – SCPs
• offer central control over the maximum available permissions for all of the accounts in your organization, ensuring member accounts stay within the organization’s access control guidelines.
• are one type of policy that help manage the organization.
• are available only in an organization that has all features enabled, and aren’t available if the organization has enabled only the consolidated billing features.
• are NOT sufficient for granting access to the accounts in the organization.
• defines a guardrail for what actions accounts within the organization root or OU can do, but IAM policies need to be attached to the users and roles in the organization’s accounts to grant permissions to them.
• Effective permissions are the logical intersection between what is allowed by the SCP and what is allowed by the IAM and resource-based policies.
• with an SCP attached to member accounts, identity-based and resource-based policies grant permissions to entities only if those policies and the SCP allow the action
• don’t affect users or roles in the management account. They affect only the member accounts in your organization.

AWS Directory Services

• gives applications in AWS access to Active Directory services
• different from SAML + AD, where the access is granted to AWS services through Temporary Credentials
• Simple AD
  • least expensive but does not support Microsoft AD advanced features
  • provides a Samba 4 Microsoft Active Directory compatible standalone directory service on AWS
  • No single point of Authentication or Authorization, as a separate copy is maintained
  • trust relationships cannot be setup between Simple AD and other Active Directory domains
  • Don’t use it, if the requirement is to leverage access and control through centralized authentication service
• AD Connector
  • acts just as an hosted proxy service for instances in AWS to connect to on-premises Active Directory
  • enables consistent enforcement of existing security policies, such as password expiration, password history, and account lockouts, whether users are accessing resources on-premises or in the AWS cloud
  • needs VPN connectivity (or Direct Connect)
  • integrates with existing RADIUS-based MFA solutions to enabled multi-factor authentication
  • does not cache data which might lead to latency
• Read-only Domain Controllers (RODCs)
  • works out as a Read-only Active Directory
  • holds a copy of the Active Directory Domain Service (AD DS) database and respond to authentication requests
  • they cannot be written to and are typically deployed in locations where physical security cannot be guaranteed
  • helps maintain a single point to authentication & authorization controls, however needs to be synced
• Writable Domain Controllers
  • are expensive to setup
  • operate in a multi-master model; changes can be made on any writable server in the forest, and those changes are replicated to servers throughout the entire forest

AWS Single Sign-On SSO

• is a cloud-based single sign-on (SSO) service that makes it easy to centrally manage SSO access to all of the AWS accounts and cloud applications.
• helps manage access and permissions to commonly used third-party software as a service (SaaS) applications, AWS SSO-integrated applications as well as custom applications that support SAML 2.0.
• includes a user portal where the end-users can find and access all their assigned AWS accounts, cloud applications, and custom applications in one place.

Amazon Cognito

• Amazon Cognito provides authentication, authorization, and user management for the web and mobile apps.
• Users can sign in directly with a username and password, or through a third party such as Facebook, Amazon, Google, or Apple.
• Cognito has two main components.
  • User pools are user directories that provide sign-up and sign-in options for the app users.
  • Identity pools enable you to grant the users access to other AWS services.
• Cognito Sync helps synchronize data across a user’s devices so that their app experience remains consistent when they switch between devices or upgrade to a new device.