Downloaded 16 times
![{
"Effect": "Allow",
"Action": [
"dynamodb:GetItem",
"dynamodb:PutItem"
],
"Resource": [
"arn:aws:dynamodb:us-east-2:111122223333:table/MyTable"
]
}
dynamodb.putItem({
TableName:"MyTable",
Item: {
"Id": {
S: "a1b2c3d4"
…
});
How authorization works in AWS
EC2 instance
with IAM role
DynamoDB
table
The “PutItem” action and the “table”
resource match the Allow statement, so
the request is allowed](https://image.slidesharecdn.com/demystifyingidentityaws-200821054244/75/Demystifying-identity-on-AWS-67-2048.jpg)
![{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "ssm:StartSession",
"Resource": [ "arn:aws:ec2:*:*:instance/*" ],
"Condition": {
"StringLike": {
"ssm:resourceTag/project": "${aws:PrincipalTag/project}",
"ssm:ResourceTag/team": "${aws:PrincipalTag/team}"
}
}
},
{
"Effect": "Allow",
"Action": "ssm:TerminateSession",
"Resource": [ "arn:aws:ssm:*:*:session/${aws:username}-*“ ]
}
]
}
Session tags ABAC policy
Identity policy attached
to IAM role for SAML
federated user](https://image.slidesharecdn.com/demystifyingidentityaws-200821054244/75/Demystifying-identity-on-AWS-100-2048.jpg)
![{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": { "Federated": "arn:aws:iam::111122223333:saml-provider/MyIDP },
"Action": [
"sts:AssumeRoleWithSAML",
"sts:TagSession"
],
"Condition": {
"StringEquals": { "SAML:aud": "https://signin.aws.amazon.com/saml" },
"StringLike": {
"aws:RequestTag/project": "*",
"aws:RequestTag/team": "*"
}
}
}
]
}
Session tags role trust policy
trust policy attached to
IAM role for SAML
federated user](https://image.slidesharecdn.com/demystifyingidentityaws-200821054244/75/Demystifying-identity-on-AWS-101-2048.jpg)
Uploaded byAWS User Group Bengaluru
Demystifying identity on AWS
The document discusses identity management on AWS, covering key concepts such as user authentication, authorization, and the use of various protocols like SAML, OpenID Connect, and OAuth2. It highlights enterprise cloud trends, identity solutions, and best practices for integrating user directories, automation, and access management across AWS. Use cases and options for AWS Single Sign-On, managed Microsoft Active Directory, and IAM roles are also illustrated, emphasizing the importance of structured identity management in cloud architectures.
More Related Content
Similar to Demystifying identity on AWS
More from AWS User Group Bengaluru
Demystifying identity on AWS
- 1. Demystifying Identity @AWS IdentitydiscussionfromEnterpriseCustomers/workloadpov/focus Amit Jha , Developer Advocate @amitkjha_rjn https://www.linkedin.com/in/amitjhanyc/
- 2. Agenda Enterprise Cloud –Trends (Modernization) Overview Basics of Identity on AWS Federation, OpenID Connect, OAuth2 Use cases, use cases and Identity solution options.. Q&A
- 3. Enterprise customer –Begin their journey to the cloud
- 5. © 2020, AmazonWeb Services, Inc. or its affiliates. All rights reserved. Initial Enterprise Setup - AWS Control Tower(Multiacctmodel) Set up an AWS landing zone Establish guardrails Automate compliant account provisioning Centralize identity and access Manage continuously
- 6. What are thekey characteristics of successful customer migration-modernization look like?
- 11. Modernization Area Identity(AuthZ,AuthN) Association Automation Builder Identity Application Architecture Identity for Apps DevSecOps, Datalake Role driven or Attribute based authentication & authorization Microservices Different identity protocol needs (oAuth, OpenID Connect, SAML) Operating model Role, Attribule, Team permissioning
- 12. Corporate vs ConsumerIdentities Corporate Consumers Quick…Identity Basics
- 13. AuthN = Authentication AuthZ= Authorization MFA = Multi Factor Authentication Identity Management Access Management Resource Management AWS Account WHO CAN ACCESS WHAT
- 14. Federation Delegating an individual’sor entity’s authentication responsibility to a trusted external party. Identity Provider (IDP) Security Assertion Markup Language(SAML) Service Provider(SP) Relying Party(RP) The trusted identity providers can be on-premises federation services, corporate directories or even social identity providers like Facebook, Google and Twitter.
- 15. User logs in toportal Corporate data center Enterprise (identity provider) AWS (service provider) Browser interface Identity store IdP portal 1 3 2 4 5 AWS sign-in User authenticated Receive response (SAML assertion) Post the SAML assertion to sign-in Redirected to AWS Management Console Identity federation with SAML 2.
- 17. OpenID Connect, oAuth2 OpenIDConnect is an interoperable authentication protocol based on the OAuth 2.0 family of specifications. OAuth 2 is an authorization framework that enables applications to obtain limited access to user accounts on an HTTP service, such as Facebook, GitHub etc.
- 18. JWT Json Web Tokensare implemented as a part of Open ID Connect and Oauthv2. Imagine that a user is logged in an application and each subsequent request will include the JWT, allowing the user to access routes, services, and resources that are permitted with that token. Tokens • Identity • Access • Refresh *expiration
- 19. SCIM & JIT SCIM(Systemfor Cross-domain Identity Management) is a protocol built by teams from Oracle, Salesforce, Sailpoint and Nexus Technology. A good example is AWS customers that want to integrate AWS SSO with Azure AD. When you enable automatic provisioning, SCIM provisions users between clouds. The Identity is provided, in this scenario by Azure AD, but the rules of access and resource definitions are done by the Service Provider. Meaning you can federate AWS with Azure AD but AWS SSO Permissions would rule for your SCIM synchronized objects. JIT provisioning is also a method of automating user account creation for web applications, it uses the SAML protocol to pass information from the identity provider to web applications
- 21. Security before thecloud Corporate data center
- 22. Then Security Corporate firewall IdentityEmployees Resources Hundreds, in a few buildings Compliance Employee passwords Administration Centralized Cloud Up in the sky
- 23. Disruptors Mobile Consumerization of IT Globalization IoT Newprivacy laws Microservices SaaS applications Cloud
- 26. Security before thecloud Security in the cloud Corporate data center AWS Cloud
- 27. AWS IAM Basics •IAM User • Entity that you create in AWS, representing the person or service who uses the IAM user to interact with AWS • IAM Group • Collection of IAM users (A management convenience) • IAM Role • Similar to a user but does not have standard long-term credentials (e.g. password or access keys) associated with it • An IAM User can assume a Role to take on the permissions of the role IAM User Role Permissions Policy attached to Request to Assume Role AWS STS Temporary security credential AWS Identity and Access Management
- 29. AWS Identity –Brief History Launch Brief Detail AWS Root User One account, One user IAM IAM Users One account, Many users SAML Federation Corp Directory users One account, Corporate users Switch Role Ability to switch role Same user switching roles AWS Organization SSO Service SSO users Many account, Many users SSO External Directory SSO + Corporate directory users Many accounts, Corporate users
- 30. AWS Security TokenService STS The AWS Security Token Service (STS) is a web service that enables you to request temporary, limited-privilege credentials for AWS Identity and Access Management (IAM) users or for users that you authenticate (federated users)
- 31. © 2020, AmazonWeb Services, Inc. or its Affiliates. Quick Demo .NET SDK – IAM Manipulation IDE integration AWS Toolkit for Visual Studio AWS Toolkit for Visual Studio Code Programmable SDK Command line tools AWS Tools for PowerShell AWS SAM for Windows AWS CLI ‘dotnet’ CLI extensions CI/CD integration AWS Tools for Azure DevOps AWS CodePipline/ CodeBuildAWS CDK for .NET AWS Toolkit for Rider AWS SDK for .NET
- 32.
- 33. Accounts in AWS AWSAccount
- 35. Accounts in AWS AWSAccount AWS Organization AWS Account AWS Account Organizational Unit AWS Account: MASTER Organizational Unit
- 36.
- 37. Security invariants withAWS Organizations AWS Cloud AWS Organization Organization Unit Account Region: us-east-1 Region: us-east-2 Region: ap-southeast-1 Region: eu-west-1 … Service Control Policy: Region Restriction
- 38. Simplifying the complexity Managingresources at scale can be broken down into three steps
- 39. Tag policies • Exporta cross-account, cross-region report to easily aggregate and view tag policy compliance • Define tag key capitalization and allowed tag values • Apply the tag policy to entire organization, specific organizational units, and individual accounts Standardize the tagging of your AWS resources Audit tagged resources Works with AWS Organizations New!
- 40. IAM users Works bestwhen you have: • A relatively small number of users (limit is 5,000) • One AWS account, or a relatively small number of them • A need for long-term credentials • No user directory, or no ability to connect your directory to AWS • Your very first AWS account AWS Account AWS Organization AWS Account Organizational Unit AWS Account: MASTER
- 41. AWS Single Sign-Onuser pool AWS Account AWS Organization AWS Account Organizational Unit AWS Account: MASTER Admin ReadOnly Admin ReadOnly Works best when you have: • A relatively small number of users (limit is 500) • Simple authorization schemes of humans into AWS • Rules to map groups of users to AWS environments • No user directory, or no ability to connect your directory to AWS
- 42. Azure AD Enterprise customerrequests
- 43. Active Directory FederationServices Works best when you have: • Corporate users in a Microsoft Active Directory, either on-premises or managed in AWS • An ADFS connected to your directory • Control over ADFS claims • A need for granular control over user permissions AWS Account AWS Organization AWS Account Organizational Unit AWS Account: MASTER Admin ReadOnly Admin ReadOnly ADFS
- 44. User logs in toportal Corporate data center Enterprise (identity provider) AWS (service provider) Browser interface Identity store IdP portal 1 3 2 4 5 AWS sign-in User authenticated Receive response (SAML assertion) Post the SAML assertion to sign-in Redirected to AWS Management Console Identity federation with SAML 2.
- 45. © 2020, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. AD on AWS supports many options Run or extend AD-dependent workloads onto EC2 or AWS Managed Services Actual Microsoft AD, HIPAA and PCI Eligible, Trust support, Group-based policies, SSO, Seamless domain join, AWS Management Console Federation, Daily snapshots A modern, hybrid approach to AD that shares privileges and data from on-premises AD to AWS Managed Microsoft AD on AWS AD as a Managed Service True hybrid AD AD-enabled cloud
- 46. © 2020, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Use case #1: Amazon EC2 - Windows and Linux instances High Fidelity • Workloads: SharePoint Server, .NET Apps, SQL Server Always-On, Amazon EC2 Linux • Active Directory security groups to control AWS resource access (RBAC or ABAC) • Create GPO’s for • standardizing settings & configurations • managing Amazon EC2 instances and Amazon WorkSpaces • Schema extension for customized applications • LDAPS and read/write LDAP • Kerberos delegation • Amazon EC2 Seamless domain join (Windows and Linux*) • Cross Account and cross VPC support * Release expected
- 47. © 2020, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Use case #2: AWS Managed Services • Centrally Managed Services - Windows file server and db’s • Scale deployments across multiple accounts and VPC’s • Flexibility to choose between on-prem or cloud identities • Seamless integration with your existing Active Directory • Supported Services • Amazon RDS for SQL Server • Amazon RDS for PostgreSQL • Amazon RDS for Oracle • Amazon RDS for MySQL • Amazon FSx for Windows File Server
- 48. © 2020, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Use case #3: AWS Single Sign-On • Create Workforce Identities once • Provision and Sync users via SCIM • Centrally Manage Identities • On-premises AD, AD on AWS EC2, AWS Managed Microsoft AD • AWS SSO, Okta, Ping Identity, OneLogin, Azure AD • Centrally Manage AWS access • Preferred interface via SAML: AWS Management Console, CLIv2, AWS mobile app • SSO access across all AWS accounts in your organization, and business apps - for employees, contractors, business partners • Smart Sign-in Security with Authenticator applications • Authy, Google Authenticator • AWS SSO (native) Integrated apps • Amazon SageMaker • AWS IoT Core • AWS Management Console
- 49. © 2020, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Use case #4: AWS Applications • Use a centrally managed Identity store • Use Active Directory security groups for controlled access • Remote desktop access, file or folder permissions • AWS application access • Amazon Chime • Amazon WorkMail • Amazon Connect • Amazon Client VPN • Amazon QuickSite • Amazon WorkSpaces • Amazon AppStream 2.0 • Amazon Workdocs
- 50. AWS SSO withAWS Directory Service AWS Cloud VPC
- 51. Provisioning and AWSapplication integration 1 2 3 4
- 52. Using AWS SSOwith Azure Active Directory with SCIM Azure AD
- 53. Authenticating to AWS:Quick decision framework If you have an existing user directory: • AWS SSO with directory integrations • Bring your own SAML federation (e.g., ADFS) • Advanced use cases: Custom federation If you don’t have an existing user directory: • AWS SSO with user pools • IAM Users
- 54. IAM roles fornon-human access AWS Account Use IAM roles for access to AWS resources from: • Your application running on an AWS compute environment, e.g., EC2 instance, Lambda function, etc. • Permission to an AWS service to access your resources (not shown) EC2 instance Lambda function Amazon S3 buckets Amazon DynamoDB Table
- 55. Creating IAM rolesfor non-human access
- 56.
- 57. Assigning AWS managedpolicies
- 58.
- 59.
- 60. Recommendation: Have atleast these two IAM roles AWS Account AWS Organization AWS Account AWS Account Organizational Unit AWS Account: MASTER Organizational Unit Admin ReadOnly Admin ReadOnly Admin ReadOnly Admin ReadOnly
- 61.
- 62. Example 1: Readdata from DynamoDB EC2 instance with IAM role DynamoDB table Least-privilege face of judgment Read/write data
- 63. Example 1: Readdata from DynamoDB EC2 instance with IAM role DynamoDB table Read/write data
- 64. Example 1: Readdata from DynamoDB EC2 instance with IAM role DynamoDB table Read/write data
- 65. Reading the IAMdocumentation page https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
- 66. Example 1: Readdata from DynamoDB EC2 instance with IAM role DynamoDB table Read/write data
- 67. { "Effect": "Allow", "Action": [ "dynamodb:GetItem", "dynamodb:PutItem" ], "Resource":[ "arn:aws:dynamodb:us-east-2:111122223333:table/MyTable" ] } dynamodb.putItem({ TableName:"MyTable", Item: { "Id": { S: "a1b2c3d4" … }); How authorization works in AWS EC2 instance with IAM role DynamoDB table The “PutItem” action and the “table” resource match the Allow statement, so the request is allowed
- 68. Permission across AWSAccounts
- 69. AWS Account AWS AccountAWS Account Accessing resources in another AWS account AWS Account 444455556666 AWS Organization AWS Account 111122223333 AWS Account: MASTER example-bucket "Principal": "*", "Condition": { "StringEquals": { "aws:PrincipalOrgId": "o-a1b2c3" } } Allow the entire Organization
- 70. Recommendations for cross-accountaccess Keep it simple: • Use resource-based policies when available • Unless you have a specific reason to do otherwise: • Trust the entire other account, or • Trust the AWS Organization • Use IAM roles if resource-based policies are not available • Follow the above rules for their trust policies (i.e., resource-based policies for IAM roles)
- 71. Identity at differentlayers Amazon Web Services (AWS) Infrastructure Application Builders Operators Users AWS Command Line Interface (AWS CLI)
- 72. Identity for theAWS layer: Managing console, AWS CLI, and API access @scale
- 73. Your options SAML toIAM AWS Single Sign- On (AWS SSO) Custom Broker
- 74. Identity “for” and“of” the infrastructure Operating systems Database engines EC2 instances DynamoDB Table S3 Bucket with objects for of
- 75. “For” the infrastructure:Options Traditional *Utopia
- 76. “Of” Infrastructure -Base primitive: IAM roles AWS credentials auto delivered and rotated AWS credentials auto discovered and used Access controlled by policy attached to role Also works with AWS Lambda & Amazon Elastic Container Service (Amazon ECS) Permissions Role Temporary security credential Your code Operating system EC2 instance AWS resources
- 77. AWS Secrets Manager(e.g. conn string, config etc) Authorized call to Secrets Manager DB creds loaded DB creds returned Connection established Safe rotation Combo provides a reliable, secure, auto-rotating solution for ALL credentials Permissions Role Temporary security credential Your code Operating system EC2 instance AWS resources VPC DBA
- 78. For the humansand the machines Credentials Container Lambda Function Service 1 Service 2 Service to serviceHuman to application
- 79. © 2018, AmazonWeb Services, Inc. or its affiliates. All rights reserved. Amazon Cognito Get AWS credentials Access AWS services Authenticate 1 Redirect / Post back Access serverless backend Federating IdP IdP Token CUP TokenCUP Token CUP Token AWS STS AWS STS User pool tokens are used to access backend resources Identity pools provide AWS credentials to access AWS services User pools authenticate users and returns standard tokens 2 3 4 56
- 80. Amazon Cognito • Applicationidentity Swiss army knife •Offloads identity focused undifferentiated heavy lifting • Normalizing layer for applications •Native and/or federated users – App doesn’t need to care • Vends standard tokens •CUP tokens – Accessing your APIs •AWS Security Token Service (AWS STS) – Accessing AWS APIs • Clean integrations with adjacent services •Amazon API Gateway – AuthN/Z for your APIs •Application Load Balancer – AuthN/Z for your apps Wikimedia Commons - By James Case from Philadelphia, Mississippi, U.S.A.
- 81. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Support for OAuth 2.0 in Cognito User Pools • OAuth 2.0 flows: • Authorization code • Implicit • Client credentials • Resource owner password credentials • Custom scopes defined for resource servers
- 82. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Amazon Cognito: Identity Scenarios Business to Consumer Business to Business Business to Employee IoT Scenarios Enterprise DirectoryEnterprise Directory SAML Enterprise Directory SAML AWS IoT
- 83. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Amazon Cognito: Services User Pools Federated Identity (Identity Pools) • Sign up/sign in • User profiles • Issue tokens • Hosted UIs • OAuth2/OIDC Identity Provider/Client • SAML2 Service Provider Federation • Guest access • AWS credentials
- 84. © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. CONFIDENTIAL and INTERNAL ONLY. Cognito User Pools - Comprehensive User Flows Email or Phone Number Verification Forgot Password User Sign-Up and Sign-In Require users to verify their email address or phone number prior to activating their account with a one-time password challenge Provide users the ability to change their password when they forget it with a one- time password challenge Allow users to sign up and sign in using an email, phone number, or username (and password) for your application. User Profile Data Enable users to view and update their profile data – including custom attributes SMS Multifactor Authentication Require users to complete a second factor of authentication by inputting a security code received via SMS as part of the sign-in flow Customize these User Flows Using Lambda Token Based Authentication Use JSON Web Tokens (JWTs) based on OpenID Connect (OIDC) and OAuth 2.0 standards for user authentication in your backend
- 85. © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. CONFIDENTIAL and INTERNAL ONLY. Cognito User Pools - Extensive Admin Capabilities Define Custom Attributes Set per-App Permissions Set up Password Policies Create and manage User Pools Define custom attributes for your user profiles Set read and write permissions for each user attribute on a per-app basis Enforce password policies like minimum length and requirement of certain types of characters Create, configure, and delete multiple user pools across AWS regions Require Submission of Attribute Data Select which attributes must be provided by the user prior to completion of the sign-up process Search Users Search users based on a full match or a prefix match of their attributes through the console or Admin API Manage Users Conduct admin actions, such as reset user password, confirm user, enable MFA, delete user, and global sign-out
- 86. © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. CONFIDENTIAL and INTERNAL ONLY. SDKs for Cognito User Pools Native Mobile app AWS Mobile SDK for iOS, Android Web app, Custom UI AWS Amplify Backend Service AWS SDK e.g., Java, Python, Node.js, etc. Web app, Hosted UI AWS Amplify OR Cognito Auth SDK for JavaScript Hybrid Mobile app AWS Amplify
- 87. © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. CONFIDENTIAL and INTERNAL ONLY. AWS Integrated Authorization Amazon API Gateway AWS Application Load Balancer AWS Credentials (Any AWS service) Cognito Tokens Cognito Tokens Cognito Tokens Amazon Cognito API GW Amazon Cognito Amazon Cognito DynamoDB, S3, etc. ALB
- 88. © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. CONFIDENTIAL and INTERNAL ONLY. API Gateway: three types of authorization Amazon Cognito User Pools Amazon Cognito Identity Pools Custom Identity Providers AWS IAM authorization Lambda Authorizers Cognito Authorizers
- 89. © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. CONFIDENTIAL and INTERNAL ONLY. Amazon Cognito User Pools Amazon Cognito Identity Pools Custom Identity Providers AWS IAM authorization Lambda Authorizers API Gateway: three types of authorization Cognito Authorizers
- 90. © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. CONFIDENTIAL and INTERNAL ONLY. Mobile app 6. Access AWS Resources Amazon DynamoDB Lambda function Amazon API Gateway Amazon Cognito User Pools Cognito User Pools Authorizers
- 91. © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. CONFIDENTIAL and INTERNAL ONLY. Amazon Cognito User Pools Custom Identity Providers AWS IAM authorization Lambda Authorizers Cognito Authorizers API Gateway: three types of authorization Amazon Cognito Identity Pools
- 92. © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. CONFIDENTIAL and INTERNAL ONLY. Mobile app 8. Invoke Lambda Lambda function Amazon API Gateway Amazon Cognito User Pools AWS Identity & Access Management Amazon DynamoDB IAM-based authorization Amazon Cognito Identity Pools
- 93. © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. CONFIDENTIAL and INTERNAL ONLY. Amazon Cognito User Pools Custom Identity Providers AWS IAM authorization Lambda Authorizers API Gateway: three types of authorization Amazon Cognito Identity Pools Cognito Authorizers
- 94. © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. CONFIDENTIAL and INTERNAL ONLY. Custom Authorizer Lambda function Mobile app Amazon API Gateway 8. Invoke AWS Identity & Access Management Lambda function Amazon DynamoDB Lambda Authorizers
- 95. Service to servicein AWS using IAM Container Lambda Function Service 1 Service 2 Permissions Role Temporary security credential Permissions AWS takes care of credential distribution Centrally defined authorizations in IAM policies Resource-based policies allows access across AWS accounts AWS Cloud
- 96. How authentication worksin AWS POST https://dynamodb.us-east-2.amazonaws.com/ HTTP/1.1 Host: dynamodb.us-east-2.amazonaws.com X-Amz-Date: 20180918T150746Z X-Amz-Target: DynamoDB_20120810.ListTables X-Amz-Security-Token: FQoGZXIvYXdzEKH////////// … Content-Type: application/x-amz-json-1.0 Authorization: AWS4-HMAC-SHA256 Credential=ASIAXXXXXXXXXXXXXXXX/20180918/us-east- 1/dynamodb/aws4_request, SignedHeaders=content- type;host;x-amz-date;x-amz-security-token;x-amz-target, Signature=c1b4bc2df0c47c86cbcfa54d932e8aaa455b6b7c38e65d84 0f722254add1ea9e
- 97. Service to servicein AWS using Amazon Cognito (OAuth) Container Lambda Function Service 1 Service 2 Permissions Role AWS Cloud CUP Token Alignment with human based authorization Bearer token model familiar to developers • You perform credential distribution (using AWS primitives)
- 98. Attribute-based access control(ABAC) “If the tag on the principal matches the tag on the resource, allow, otherwise deny.”
- 99. Session tags Principal tags→ dynamic policies Session tags → dynamic roles New!
- 100. { "Version": "2012-10-17", "Statement": [ { "Effect":"Allow", "Action": "ssm:StartSession", "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "StringLike": { "ssm:resourceTag/project": "${aws:PrincipalTag/project}", "ssm:ResourceTag/team": "${aws:PrincipalTag/team}" } } }, { "Effect": "Allow", "Action": "ssm:TerminateSession", "Resource": [ "arn:aws:ssm:*:*:session/${aws:username}-*“ ] } ] } Session tags ABAC policy Identity policy attached to IAM role for SAML federated user
- 101. { "Version": "2012-10-17", "Statement": [ { "Effect":"Allow", "Principal": { "Federated": "arn:aws:iam::111122223333:saml-provider/MyIDP }, "Action": [ "sts:AssumeRoleWithSAML", "sts:TagSession" ], "Condition": { "StringEquals": { "SAML:aud": "https://signin.aws.amazon.com/saml" }, "StringLike": { "aws:RequestTag/project": "*", "aws:RequestTag/team": "*" } } } ] } Session tags role trust policy trust policy attached to IAM role for SAML federated user
- 102. Configure IdP forsession tags AWS Security Blog Attributes → standard Configurations → IdP specific
- 103. ABAC (Attribute BasedAccess Control) – Leverage session tags https://aws.amazon.com/blogs/mt/configure-session-manager- access-for-federated-users-using-saml-session-tags/
- 104. Suitable for somevery unique authorization usecases : Custom brokers Custom Broker Underlying compute IAM role AWS Cloud Example Corp. user AuthN/Z Determine granular entitlements Assess environment and/or context Generate session policy sts:AssumeRole with session policy “on behalf of” the authorized user
- 105. Fine grained permissioning AWSlake formation helps you set up a secure data lake in days. A data lake is a centralized, curated, and secured repository that stores all your data, both in its original form and prepared for analysis. • You can use Lake Formation to centrally define security, governance, and auditing policies in one place, versus doing these tasks per service • Eliminates the need to manually configure them across security services like AWS Identity and Access Management and AWS Key Management Service, storage services like S3, and analytics and machine learning services like Redshift, Athena, and (in beta) EMR for Apache Spark. This reduces the effort in configuring policies across services and provides consistent enforcement and compliance. • E.g. https://aws.amazon.com/blogs/big-data/enable-fine-grained-permissions- for-amazon-quicksight-authors-in-aws-lake-formation/
- 106.
- 107. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved. 30+ free digital courses cover topics related to cloud security, including Introduction to Amazon GuardDuty and Deep Dive on Container Security Learn security with AWS Training and Certification Visit aws.amazon.com/training/paths-specialty/ Classroom offerings, like AWS Security Engineering on AWS, feature AWS expert instructors and hands-on activities Validate expertise with the AWS Certified Security - Specialty exam Resources created by the experts at AWS to help you build and validate cloud security skills
- 108. Access management isa journey CC0 Public domain