JUSTIN SAMUEL

SCS-C03 #1: IAM.

Note: This is the first post in my AWS SCS-C03 series. You can see the rest of the posts in the series using the link above.

  • An AWS account is a container for AWS identities (users) and resources (ex. EC2 instances, S3 buckets, etc).
  • The first identity created in an AWS account is the root user / root account.
    • The root account should only be used for billing reasons, closing the AWS account down, and changing account settings. For any other use, a separate admin or default user account (known as an IAM user account) should be created.
    • This allows for separation of duties and reduces attack spread in case of account infiltration (since a hacker may gain access to the admin account or a default user account, but not the root account).
    • Using multi-factor authentication (MFA) can help improve the security of the root account.
    • It is of utmost importance to protect the root user account because access to this gives an attacker access to every service available in AWS.

  • IAM users can be added to groups and assigned permissions using IAM policies. Permissions can be added to groups, or directly to users themselves. For time efficiency, it’s better to add IAM users to groups, and then add permissions to groups.
    • IAM Users are intended for use by humans only.
    • IAM Roles can be assigned to external identities and AWS services. This allows them to gain access to your account and perform tasks.
    • IAM Access Keys can be used to access AWS services using a command-line interface (CLI). These are long-term keys and can be rotated in case of a leak. These keys can be created, deleted, and also made active, or inactive. Access keys are made up of an Access Key ID, and a Secret Access Key – you’ll need both to connect via a CLI.
    • Using multi-factor authentication (MFA) can help improve the security of an IAM user and is strongly recommended for all users.

  • Authentication vs. Authorisation:
    • Authentication is about proving who you are.
    • Authorisation is about checking you have the permissions to access or do something.

Thanks for reading!

-J

More reading:

Leave a comment