What are the most important AWS IAM best practices for cloud security?

Implementing the principle of least privilege ensures your users and applications have only the permissions they need to perform their tasks. The principle of least privilege helps improve compliance, contain breach damage and also reduce the attack surface of your environment. Implementation within AWS includes using IAM roles/policies to grant permissions to users, resource-based policies to manage permissions to specific resources and also leveraging IAM policy conditions for fine-grained access control. AWS also provides several tools such as AWS Security Hub, AWS Config, and IAM Access Analyzer that will assist you with principle of least privilege implementations.

The temptation to add a * to your policies will be very high. Time pressures to get things working often compounds this and leads to permissive policies that cause pain later. Managing expectations can really help here - make sure you communicate to colleagues and stakeholders that getting the permissions/policies right will take time.

When combined with Single Sign-On(SSO), MFA provides that extra layer protection which is proved to be strong enough for phishing, password theft, or brute force attacks. What is sometimes forgotten about complex password policy and frequent renewal of it. Root user access to be blocked where possible as well, instead IAM access to be used. Microsoft Entra e.k.a provides this functionality by default and other provider like Okta can augment this when Identity provider for cloud is third party entity.

I'll come back to that later is the greatest gift to an attacker, and with MFA this is doubly true! Best advice regarding MFA is invest some time in choosing a platform you can access from multiple devices, ideally with some form of secure synchronisation. A high-quality password manager can usually manage the MFA for you too.

While access keys provide easier access to AWS cloud environment, it should be avoided. Access keys require regular renewal and/or revocation which leads to higher operational and maintenance cost. While used in automation, needs to monitor regularly for any leak and compromised access. AWS IAM Role to be used instead while accessing resources within AWS and Federated authentication while accessing resources from outside AWS.

This is the area where cyber security team is very interested in. Coupled with AWS CloudTrail, ClowdWatch and Config, AWS IAM Access Advisor can show any excessive permission provided via IAM user/role. A monitoring dashboard has to be set-up to show privileged access and alerted accordingly for any suspicious activity e.g. adding multiple DNS records in quick succession of time.

Duplication if identity can lead to identity misuse and impersonation attack. It is very tempting to start with local identity, to be founded that it is being used for production environment and hard to change. This is the baseline requirement for Identity and access management of the cloud. It will not only protect from any attack but also provide the control to enable or revoke access with press of a button.

This can make a massive difference, and is our standard approach when deploying customers using JumpCloud. By integrating AWS access via SAML, you can deliver access simply by adding a user to a group, relying on the SAML platform to manage authentication/MFA!

AWS can interface with third-party authentication/authorisation platforms or by your central auth resource. Migrating from one platform to another later can be a very costly exercise, so it's worth spending time on this early on!

Microsoft is a dominant player in Identity management space and leveraged it very well in their management and control of access to resources. But of the access currently provided is privileged access and remain there for long term. To prevent it, AWS has come up with custom solution called Temporary access management and Privileged Identity Management by Azure which is AAD integrated. By leveraging Privileged Identity Management, temporary or short term access can be provided which is time bound and will expire after the duration it has been approved for. It will further reduce attack surface and protect from privilege escalation.