Learn how to use JIT access to simplify your AWS permissions set and improve your AWS security game

1. Communit
y
AWS Community
Secure from Day-0: Increase Your
Security Posture with Temporary Elevated
Access and AWS IAM Identity Center
Andrey Devyatkin
AWS Las Palmas User Group

2. AWS Community
Andrey Devyatkin
Cloud Engineering Specialist
Co-Founder at FivexL
Co-Host at DevSecOps
Talks podcast
AWS Community Builder
AWS User Group Leader
Happy resident of Las Palmas

3. How do people get to their AWS
account?

4. Root user

7. https://github.com/fivexl/terraform-aws-cloudtrail-to-slack

9. Static IAM users

11. AWS Community
- static
- password policy and rotation
- local to one account
Problems with static iam users

12. IAM Role chaining and
Cross-account IAM Nightmare

13. AWS Community
First day as a new CISO

14. AWS Community
First day as a new CISO

15. AWS IAM Identity Center

17. Granting permissions.
Role-based access control.

18. AWS Community
- Developer Bob needs to get data from Production Database
- Bob asked his team lead Kate for permissions
- Kate told that company policy don’t allow access to Production Database and she have to ask CTO
- CTO was busy for a week and finally response that this is okay to grant Bob required permissions
and also change a policy and etc
- Kate asked InfraSec team to implement new security policy and grant Bob required permissions
- Bob finally able to get data from database and it allows him to implement new feature in the
codebase
How it usually happens?

19. AWS Community
- Time. Depends of the company size this process could takes from days to weeks.
- Maintenance. As company grows it will be more and more complex systems with many groups and
roles.
- Security. Our developer or developers will permanently have new permissions.
What problems do we see?

20. Temporary Elevated Access

21. AWS Community
Temporary elevated access (also known as just-in-time access) is a way to request, approve, and track
the use of a permission to perform a specific task during a specified time. Temporary elevated access
supplements other forms of access control, such as permission sets and multi-factor authentication.
Temporary Elevated Access
Approve Action
Request
More info:
https://docs.aws.amazon.com/singlesignon/latest/userguide/temporary-elevated-access.html

22. AWS Community
Another way of getting access

23. Sounds interesting.
How could I do it in my company?

24. AWS Community
AWS Organizations
More info: https://aws.amazon.com/organizations/

25. AWS Community
AWS IAM Identity Center (AWS Single Sign-On)
More info: https://aws.amazon.com/iam/identity-center/

26. AWS Community
Validated AWS Security Partners for temporary
elevated access
More info:
https://docs.aws.amazon.com/singlesignon/latest/userguide/temporary-elevated-access.html#vali
datedpartners

27. AWS Community
Temporary elevated access management
(TEAM)
More info: https://aws-samples.github.io/iam-identity-center-team/

28. terraform-aws-sso-elevator

29. AWS Community
SSO-Elevator
More info: https://github.com/fivexl/terraform-aws-sso-elevator

30. AWS Community
SSO-Elevator (demo)
More info: https://youtu.be/iR3Rdjd7QMU