Module 5: Securing Access

AWS Academy Cloud Architecting

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Module overview
Sections Demonstration
• EC2 Instance Profile
1. Architectural need

2. Account users and IAM

Activity
3. Organizing users • Examining IAM policies
4. Access to AWS
Lab
5. IAM Roles
• Challenge Lab: Controlling AWS
6. Securing your account Account Access by Using IAM
Knowledge check

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 2
Module objectives
At the end of this module, you should be able to:
• Explain the purpose of AWS Identity and Access Management (IAM) users,
groups, and roles
• Describe how to allow user federation within an architecture to increase security
• Recognize how AWS Organizations service control policies (SCPs) increase
security within an architecture
• Describe how to manage multiple AWS accounts
• Configure IAM users

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 3
Section 1: Architectural need
Module 5: Securing Access

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Café business requirement

The café needs to define what level of access users and systems should have
across cloud resources and then put these access controls into place across
the AWS account.

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 5
Section 2: Account users and IAM
Module 5: Securing Access

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Secure the root account
The account root user has a large amount of power. Recommended security steps:

1. Create an IAM admin user

Root user

2. Lock away the root user credentials

5. Further access to account for most tasks

via

IAM user

AWS AWS Command AWS Tools and

Management Line Interface software development
Console (AWS CLI) kits (SDKs)
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 7
AWS Identity and Access Management (IAM)

Securely control individual and group

access to your AWS resources

Integrates with other AWS services

AWS Identity and
Access Management Federated identity management
(IAM)

Granular permissions

Support for multi-factor authentication

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 8
AWS Identity and Access Management (IAM)

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 9
IAM components: Review

Defined in your AWS account. Use credentials to

authenticate programmatically or via the AWS
Management Console.
IAM user

A collection of IAM users that are granted Amazon Elastic

identical authorization. Full Compute Cloud
access (Amazon EC2)
IAM group instances
Read- Amazon Simple
Defines which resources can be accessed IAM user, only Storage Service
and the level of access to each resource. IAM group, (Amazon S3)
or IAM role IAM
IAM policy policies
bucket

Mechanism to grant temporary access for

making AWS service requests. Assumable
IAM role by a person, application, or service.

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 10
IAM permissions

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 11
IAM permissions

How IAM determines permissions at the

time of request:
IAM policy
Is the Is the
Permissions are specified in an IAM policy: permission No permission No Deny
explicitly explicitly
• A document formatted in JavaScript Object denied ? allowed ? Implicit
Notation (JSON)
Yes deny
Yes
• It defines which resources and operations are
allowed Deny Allow
• Best practice – follow the principle of least privilege
• Two types of policies –
• Identity-based: Attach to an IAM principal
• Resource-based: Attach to an AWS resource

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 12
Identity-based versus resource-based policies

Identity-based policies Resource-based policies

• Attached to a user, group, or role • Attached to AWS resources
• Types of policies • Example: Attach to an Amazon S3
bucket
• AWS managed
• Always an inline policy
• Customer managed
• Inline

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 13
 IAM policy document structure
{ • Effect: Effect can be either Allow or Deny
"Version": "2012-10-17",
"Statement":[{ • Action: Type of access that is allowed or denied
"Effect": "effect",
"Action": "action", "Action": "s3:GetObject"

"Resource": "arn",
"Condition":{ • Resource: Resources that the action will act on
"condition":{
"Resource": "arn:aws:sqs:us-west-2:125456789012:queue1"
"key": "value"
}
} • Condition: Conditions that must be met for the rule to apply
}]
"Condition" : {
}
"StringEquals" : {
"aws:username" : "johndoe"
}
}
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 14
ARNs and wildcards

• Resources are identified by using Amazon Resource Name (ARN) format

• Syntax – arn:partition:service:region:account:resource
• Example – "Resource": "arn:aws:iam::125456789012:user/mmajor"

• You can use a wildcard (*) to give access to

all actions for a specific AWS service
• Examples –
• "Action": "s3:*"
• "Action": "iam:*AccessKey*"

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 15
IAM policy example

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 16
 Activity:
Examining IAM
policies

Photo by Pixabay from Pexels.

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 17
Activity: IAM policy analysis (1 of 5)

Consider this IAM policy, then answer the questions.

1. Which AWS service does this policy grant you access to?
{ 2. Does it allow you to create an IAM user, group, policy, or
"Version": "2012-10-17", role?
"Statement": {
3. Go to
"Effect": "Allow", [Link]
"Action": [ and in the left navigation expand Reference > Policy
"iam:Get*", Reference > Actions, Resources, and Condition Keys.
"iam:List*" Choose Identity And Access Management. Scroll to the
Actions Defined by Identity And Access Management list.
],
"Resource": "*" Name at least three specific actions that the iam:Get*
} action allows.
}

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 18
Activity: IAM policy analysis (1 of 5) - Answers

Consider this IAM policy, then answer the questions.

1. Which AWS service does this policy grant you access to?
{ • ANSWER: The IAM service.
"Version": "2012-10-17", 2. Does it allow you to create an IAM user, group, policy, or
"Statement": { role?
"Effect": "Allow", • ANSWER: No. The access is limited to get and list
"Action": [ requests. It effectively grants read-only permissions.
"iam:Get*", 3. Go to
"iam:List*" [Link]
], and in the left navigation expand Reference > Policy
Reference > Actions, Resources, and Condition Keys.
"Resource": "*" Choose Identity And Access Management. Scroll to the
} Actions Defined by Identity And Access Management list.
}
Name at least three specific actions that the iam:Get*
action allows.
• ANSWER: iam:Get* allows many specific actions,
including GetGroup, GetPolicy, GetRole, and others.

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 19
Activity: IAM policy analysis (2 of 5)

Consider this IAM policy, then answer the questions.

1. Does the policy allow you to terminate any EC2 instance
at any time without conditions?
2. Are you allowed to make the terminate instance call from
anywhere?
3. Can you terminate instances if you make the call from a
server that has an assigned IP address of [Link]?

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 20
Activity: IAM policy analysis (2 of 5) - Answers

Consider this IAM policy, then answer the questions as they are presented.
1. Does the policy allow you to terminate any EC2 instance
at any time without conditions?
• ANSWER: No. The first statement object allows it.
However, the second statement object applies a
condition.
2. Are you allowed to make the terminate instance call from
anywhere?
• ANSWER: No. You can only make the request from
one of the two IP address ranges that are specified in
aws:SourceIp.
3. Can you terminate instances if you make the call from a
server that has an assigned IP address of [Link]?
• ANSWER: Yes, because the [Link]/24 Classless
Inter-Domain Routing (CIDR) IP address range
includes IP addresses [Link] through [Link].
A resource like the CIDR to IP Range tool can be used
to calculate the range of a CIDR block.

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 21
Activity: IAM Policy analysis (5 of 5)

Consider this IAM policy, then answer the questions.

{ 1. What actions does the policy allow?
"Version": "2012-10-17",
"Statement":[{
2. Say that the policy included an additional statement object,
"Condition": {
like this example:
"StringNotEquals": { {
"ec2:InstanceType": [ "Effect": "Allow",
"[Link]", "Action": "ec2:*",
"[Link]" "Resource": "*"
]
}
}
}, How would the policy restrict the access granted to you by
"Resource": "arn:aws:ec2:*:*:instance/*", this additional statement?
"Action": [
"ec2:RunInstances", 3. If the policy included both the statement on the left and the
"ec2:StartInstances" statement in question 2, could you terminate an [Link]
], instance that existed in the account?
"Effect": "Deny"
}
]

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 22
Activity: IAM Policy analysis (5 of 5)

Consider this IAM policy, then answer the questions.

{ 1. What actions does the policy allow?
"Version": "2012-10-17", • ANSWER: It does not allow you to do anything (the effect is to
"Statement":[{ Deny).
"Condition": { 2. Say that the policy included an additional statement object, like this
"StringNotEquals": { example:
"ec2:InstanceType": [ {
"[Link]",
"Effect": "Allow",
"[Link]"
"Action": "ec2:*”,
] "Resource": "*"
} }
},
"Resource": "arn:aws:ec2:*:*:instance/*", How would the policy restrict the access granted to you by this
"Action": [ additional statement?
"ec2:RunInstances", • ANSWER: You would have full Amazon EC2 service access. However
"ec2:StartInstances" you would only be allowed to launch or start EC2 instances of
], instance type [Link] or [Link].
"Effect": "Deny" 3. If the policy included both the statement on the left and the statement
} in question 2, could you terminate an [Link] instance that existed in
] the account?
• ANSWER: Yes.

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 23
Section 2 key • Avoid using the account root user for common
tasks. Instead, create and use IAM user credentials.
takeaways
• Permissions for accessing AWS account resources
are defined in one or more IAM policy documents.
• Attach IAM policies to IAM users, groups, or roles.

• When IAM determines permissions, an explicit

Deny will always override any Allow statement.

• It is a best practice to follow the principle of least

privilege when you grant access.

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 24
Section 5: Organizing users
Module 5: Securing Access

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
IAM groups
Use IAM groups to grant the same access
rights to multiple users. One-off approach to
managing access.

• All users in the group inherit the Access

Attached
permissions assigned to the group IAM policy A
to
IAM User
resource
• Makes it easier to manage access across
multiple users
IAM policy B
Tip: Combine approaches for fine-
grained individual access More manageable
IAM User
• Add the user to a group to apply approach.
standard access based on job function member
of
• Optionally attach an additional policy to Access
the user for needed exceptions IAM policy A Attached IAM Group
resource
to

IAM policy B
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 26
Example IAM groups

Tip: Create groups that reflect job functions

AWS
account
• If a new developer is hired, add them to the
IAM Group: IAM Group: IAM Group: Developer group
Admins Developers Test
• Immediately inherit the same access granted to
other developers
Li Mateo Ana
• If Ana takes on the new role of developer –
Paulo Shirley Zhang • Remove her from the Test group
• Add her to the Developer group

Sofía Jane
• Users can belong to more than one group
• However the most restrictive policy will then apply

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 27
Use case for IAM with Amazon S3

IAM policy grants read, write, list access

Bucket with home
to /awsexamplebucket/home/zhang directories for each
employee and a share
Attached area for groups.
Developer to

IAM user

zhang
Member
of

IAM group

IAM policy grants read, write, list access

to /awsexamplebucket/share/developers

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 28
IAM Group

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 29
Section 4: Access to AWS
Module 5: Securing Access

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Access Key

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 31
AWS Access Key

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 32
AWS CLI

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 33
AWS CLI

AWS CloudShell: Region Availability

AWS CloudShell: Region Availability
In the next lecture, I will demo AWS CloudShell.
It is not yet available in all regions, and you can find the region list
here: [Link]

Please switch to one of these regions if you want to do the next (optional) hands-on.

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 34
AWS SDK

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 35
Section 5: IAM Roles
Module 5: Securing Access

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
IAM roles
• IAM role characteristics AWS account 2
• Provides temporary security credentials IAM
• Is not uniquely associated with one person user

• Is assumable by a person, application, or service

• Is often used to delegate access AWS
account 1 5
• Use cases Role used S3
• Provide AWS resources with access to AWS services to access bucket
IAM User
• Provide access to externally authenticated users Role
assumed
• Provide access to third parties 2by
EC2 instance
• Switch roles to access resources in – (with
Attached application)
• Your AWS account to
IAM role 1 IAM policy
• Any other AWS account (cross-account access)

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 37
IAM roles

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 38
Demonstration:
EC2 Instance
Profile

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 39
Summary: EC2 instance profile demonstration
Scenario:
• An application that runs on an EC2 AWS Cloud
instance needs access to an S3 bucket Application has
permissions to
Amazon EC2 instance access the S3
bucket
Solution: Application
5
• Define an IAM policy that grants access S3 bucket
to the S3 bucket Role assumed by
2
• Attach the policy to a role the EC2 instance

• Allow the EC2 instance to assume the

attached
role IAM role IAM policy
1
grants access
to bucket

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 40
Section 6: Securing your account
Module 5: Securing Access

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Password Policy

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 42
Multi-Factor Authentication (MFA)

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 43
Multi-Factor Authentication (MFA)

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 44
Multi-Factor Authentication (MFA)

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 45
IAM Security Tools

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 46
IAM Best Practices

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 47
 Module 5 –
Challenge Lab:
Controlling AWS
Account Access
by Using IAM

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 48
The business need: User access control

The café must define what level of

access users should have across
cloud resources. They must then
put these access controls into
place across the AWS account.

When Mateo visited the café

recently, he told Sofía about the
features of the IAM service. She
plans to use IAM to accomplish
her objective.
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 49
Challenge lab: Tasks
1. Configuring an IAM group with policies and an IAM user
2. Logging in as Nikhil and testing access
3. Configuring IAM for database administrator user access
4. Logging in as the database administrator and resolving the
database connectivity issue
5. Using the IAM Policy Simulator and creating a custom IAM policy
with the visual editor

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 50
Challenge lab: Final product
AWS Cloud Region Parameter
IAM resources Store

CafeRole – attached to Public subnet

EC2 instance
vocuser
(Sofía)
Cloud9 access
EC2 instance EC2 instance
AppDevelopers café app DEV
member of café app PROD
IAM Group attached instance instance

Nikhil IAM policies

Private Subnet 1
RDS
DBAdministrator MariaDB
member of s attached instance
IAM Group
IAM policies Private Subnet 2
Olivia

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 51
~ 80 minutes

Begin Module 5 –
Challenge Lab:
Controlling AWS
Account Access by Using
IAM

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 52
Challenge lab
debrief:
Key takeaways

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 53
Module wrap-up
Module 5: Securing Access

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Module summary

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 55
Complete the knowledge check

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 56
 Sample exam question
A company is storing an access key (access key ID and secret access key) in a text file on a custom AMI.
The company uses the access key to access DynamoDB tables from instances created from the AMI.
The security team has mandated a more secure solution.
Which solution will meet the security team’s mandate?
Choice Response

A Put the access key in an S3 bucket, and retrieve the access key on boot from the instance.

B Pass the access key to the instances through instance user data.

C Obtain the access key from a key server launched in a private subnet.

Create an IAM role with permissions to access the table, and launch all instances with the new
D
role.

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 57
 Sample exam question answer
A company is storing an access key (access key ID and secret access key) in a text file on a custom AMI.
The company uses the access key to access DynamoDB tables from instances created from the AMI.
The security team has mandated a more secure solution.
Which solution will meet the security team’s mandate?
The correct answer is D.
The keywords in the question are “storing an access key”, “DynamoDB tables from instances”,
“custom AMI”, and “most secure solution”.

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 58
Additional resources
• AWS Well-Architected Framework – Security Pillar
• IAM FAQs
• Creating IAM policies video
• Identity at different layers video
• Identity Providers and Federation

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 59
Thank you

Corrections, feedback, or other questions?

Contact us at [Link]
All trademarks are the property of their owners.

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 60