AWS identity services - Enabling & securing your cloud journey - SEC202 - Santa Clara AWS Summit.pdf

© 2019, Amazon Web Services, Inc. orits affiliates. All rights reserved.S UM M I T
An overview of AWS identity services:
enabling and securing your cloud
journey
Quint Van Deman
Business Development Manager, Identity & Directory Services
Amazon Web Services
S E C 2 0 2

Calibration

Disambiguation
Identity
Authentication, authorization,
audit, and governance for your
cloud workloads
Our scope for today
AWS Identity and Access
Management (IAM)
(the service)
Authenticates and authorizes
AWS APIs
Includes
(the subject)

Our backdrop: Typical journey to AWS
TIME
VALUE

Our goal: Shrinking the foundation

Our metaphor
AWS
Infrastructure
Application
Builders
Operators
Users
AWS
Command Line Interface (AWS
CLI)

Likely first questions
• How many AWS accounts do I need?
• How do I govern my AWS accounts?
• How do I provide access into those accounts?
• What permissions do my users have in those accounts?

AWS identity services
Application
Infrastructure
AWS platform
AWS Organizations

Introducing AWS Organizations
Govern access to AWS
services, resources, and
regions
Central governance and management for multiple
AWS accounts
Configure AWS services
across multiple AWS
accounts
Automate AWS
account creation
and management
Consolidate billing across
multiple AWS accounts

Primer: AWS accounts
What really is an AWS account?
• A container for AWS resources
• A clear isolation boundary for:
• Administration
• Network access
• Permissions/Resource sharing
You can have any number of AWS accounts you want (within limits)
One account designated as the master account, others are member accounts

What AWS accounts do I need?
AWS opinionated views, solutions, and services

What AWS accounts do I
need?
Common options:
• Per environment (dev, test, prod)
• Per business unit per environment
• Per app per environment
• Per app per region per environment
Seek a reasonable balance:
• Isolation vs. maturity
• Evolve over time
Refining your own opinion

AWS Organizations: Governing AWS accounts
AWS Organizations
Service control
policies
Service control
policies
us-east-1
us-west-2
ap-south-1
AWS account

AWS Organizations: Managing AWS accounts
AWS Artifact AWS CloudTrail Amazon CloudWatch AWS Config AWS Directory Service
AWS Firewall Manager AWS License Manager AWS Resource
Access Manager
AWS Service Catalog AWS Single Sign-On
AWS Services that you can use with AWS Organizations
More coming!

Next: Account access

Application
Infrastructure
AWS platform
AWS Organizations AWS SSO

Introducing AWS Single Sign-On (AWS SSO)
Centrally manage SSO access to multiple AWS accounts and
business applications for your workforce
Centrally manage
access to multiple
AWS accounts
Easy to enable
and use
Use your choice of
existing or cloud
native identities
Provide SSO access to
business applications

AWS SSO: Your choice of identity store
AWS CloudCorporate data center
Active
Directory AWS Directory Service AWS SSO
Users &
Groups
Option 1: Use corporate identities by connecting to
and existing directory
AWS Cloud
AWS SSO
Users &
Groups
Option 2: Create users in AWS SSO

AWS SSO: Define permission sets
Master account
Member acct 1 Member acct N
Uses AWS Organizations to retrieve your list and
structure of accounts.
Define permissions using standard syntax and
tools.
Definitions and policies automatically deployed
and maintained in member accounts.

AWS SSO: Assign permission sets
Master account
Select users or
groups
Select desired
permission set
Grant access to one AWS
account, an OU, or the
entire Organization

AWS SSO: User experience
User authenticates
Permission sets they’ve
been granted
Options for console or
CLI/API access
Access other business
applications

What permissions do I give my users?
Least privilege is a journey,
not a starting point

Application
Infrastructure
AWS platform
AWS Organizations IAMAWS SSO

Introducing AWS Identity and Access Management (IAM)
Securely manage access to AWS services and resources
Authenticateand
authorize AWS APIs
Specify policy-based
permissions
Provide fine-grained
access controls for
AWS actions and
resources
Provide short-term
credentials for
humans, machines,
and applications

IAM policy basics
PARC model:
• Principal – Who
• Action – Can access
• Resource – What
• Condition – Under what
conditions
{
"Version": "2012-10-17",
"Statement": [ {
"Effect": "Allow",
"Action": [ "ec2:AttachVolume", "ec2:DetachVolume" ],
"Resource": "arn:aws:ec2:*:*:instance/*",
"Condition": {
"StringEquals": {
"ec2:ResourceTag/Department": "Development“
}
}
} ]
}
P

Short-term credential basics
Macro pattern 1:
Trust-based exchange
Macro pattern 2:
AWS delivered credentials
Sourcecredential
Time bound
credentials returned
Assuming a role through pre-
established trust
AWS compute service
Provideidentity by passing a
role
Time bound credentials
delivered and rotated

Further exploration
Understanding IAM primitives Understanding IAM policy
AWS re:Invent 2018: A Practitioner's
Guide to Securing Your Cloud (Like an
Expert) (SEC203-R1)
AWS re:Invent 2018: Become an
IAM Policy Master in 60 Minutes
or Less (SEC316-R1)

AWS account
AWS account
SAML federation into IAM
AWS account
SAML federation for the AWS
Management Console, APIs, and CLI
Self-paced
workshop materials
Achieve the same core result as SSO, more assembly level

It doesn’t depend
So you want to manage access for a whole
bunch of users into a whole bunch of roles
in a whole bunch of AWS accounts?
Based on features available as of March 2019; will
change based on future launches.

Cloud builders: Ready to get building!
AWS account
VPC
Amazon RDS
Amazon EC2
Application
“Control plane” – AWS APIs
(creating, terminating, etc.)
Builder
Operator
DBA
“Data plane” – VPC connections
(SSH, RDP, Database clients, etc.)

• How do I centrally authenticate users connecting to operating systems?
• How do I control which users can connect to which instances?
• How do I manage DBA access into relational database engines?
• How do I manage service accounts (non-interactiveusers)?

Application
Infrastructure
AWS platform
AWS Organizations AWS Directory ServiceIAMAWS SSO

Introducing: AWS Directory Service
Managed Microsoft Active Directory in the AWS Cloud
Easily migrate your
directory-dependent
workloads by leveraging a
managed service
Provide infrastructure
access management
without syncing identity
data
Use actual Microsoft
Active Directory integrated
with other AWS services and
applications

Establishing Active Directory in AWS
AWS CloudCorporate data
center
Active
Directory AWS Managed
Microsoft AD
Users &
Groups
LDAP,
Kerberos,
Referrals
Trust
Option 1: AWS Managed Microsoft AD with Trust Option 2: AD Connector with Service Principal
center
Active
Directory AD Connector
Users &
Groups
LDAP,
Kerberos
Service
princ.
Option 3: Stand alone AWS Managed Microsoft AD
AWS Cloud
AWS Managed
Microsoft AD
Users &
Groups
Option X: Combinations of the above
Option 4: Active Directory on EC2
with Replication
center
Active
Directory
Self-managed
Active Directory
Users &
Groups
Replication

Leveraging Active Directory in AWS
center
Active
MicrosoftAD
Users &
Groups
LDAP,
Kerberos,
Referrals
Trust
Amazon EC2
(Windows/Linux)
Amazon RDS for SQL Server
Amazon WorkSpaces
Amazon Chime Amazon WorkDocs Amazon WorkMail
Amazon QuickSight Amazon Connect
Amazon FSx
VPC AWS managed applications
Windows
application
Operator
access
User access
Domain
join
Provisioning

It doesn’t depend
Operator access
to EC2 Op
System
Operator access
to Amazon RDS
SQL Server
User access to AWS
managed
applications
Amazon FSx User access to
apps on EC2
Managed Active Directory
w/2-way trust
Managed Active Directory
w/1-way trust
AD Connector
AWS ManagedMicrosoft AD (standalone)
Self-managed Active Directory on
EC2
Choosing the right option to extend Active Directory domain services into AWS
Current as of March 2019. Always consult documentationfor latest information.

Further exploration
AWS Managed Microsoft AD deep dive
AWS re:Invent 2018: Microsoft Active
Directory Deep Dive (WIN303-R1)

Identity for the infrastructure: Future steps
Traditional Utopia
• Domain joining

• How do I securely connect to AWS APIs from my infrastructure components?
• How do I managed and deploy application credentials for connecting to
relational databases?

Deeper look: IAM roles for AWS compute services
AWS credentials auto
delivered and rotated
AWS credentials auto
discovered and used
Access controlled by policy
attached to role
Your code
Operating
system
Amazon EC2
instance
AWS resources
Also works with AWS Lambda & Amazon Elastic Container Service (Amazon ECS)
Permissions
Role
Temporary
security credential
AWS SDKs
Amazon DynamoDB
Amazon Kinesis
Amazon S3

Accessing your resources
IAM roles provide your applications a
reliable, secure, auto-rotating
solution for
AWS credentials
But what about:
Database connection credentials?
Third-party API keys?
OAuth refresh tokens?
How do we avoid the back
alley exchange?

Application
Infrastructure
AWS platform
AWS Organizations AWS Secrets ManagerAWS Directory ServiceIAMAWS SSO

Introducing AWS Secrets Manager
Lifecycle management for secrets, such as database credentials
and API keys
Rotate secrets safely Pay as you goManage access with fine-
grained policies
Secure and audit
secrets centrally

AWS Secrets Manager
Your code
Operating
system
EC2
instance
AWS resources
Permissions
Role
Temporary
security credential
AWS SDKs
Amazon DynamoDB Amazon Kinesis
AWS Secrets Manager
VPC
Amazon RDS
DBA
AWS CloudFormation
Authorized call to
Secrets Manager DB creds
loaded
DB creds
returned
Connection
established
Safe
rotation
Combo provides a reliable, secure, auto-rotating solution for all credentials

Further exploration
Secrets Manager
workshop

Applications: Ready for users!
AWS account
VPC
Amazon RDS
Amazon EC2
Application Resource access:
Relational databases
Builder
Operator
DBA
API access:
AWS servicesAmazon S3
AWS Secrets Manager
User

• How do I add sign-up and sign-in to my applications easily?
• How do I add support for standards like OIDC or SAML?
• How do I control access to business applications for my workforce?

Application
Infrastructure
AWS platform
AWS Organizations AWS Secrets ManagerAWS Directory ServiceIAM Amazon CognitoAWS SSO

Introducing Amazon Cognito
Simple and secure user sign-up, sign-in, and access control for
web and mobile apps
Offload undifferentiated
identity heavy lifting
Provide advanced
security for your apps
and users
Use standards-based
authentication
Use your choice of
existing or cloud
native identities

Amazon Cognito
Get AWS credentials
Access AWS services
Authenticate 1
Redirect /
Post back
Access serverless backend
Federating
IdP
IdPToken
CUP TokenCUP Token
CUP Token
AWSSTS
AWSSTS
User pool tokens are used to
access backend resources
Identity pools provide AWS
credentials to access AWS
services
User pools authenticate users
and returns standard tokens
2
3
4
56
Amazon Cognito
Amazon API Gateway AWS Lambda
Amazon Cognito
Amazon DynamoDB Amazon S3

Further exploration
Serverless Authenticationand
Authorization session
Serverless Authenticationand
Authorization workshop

Revisiting where we got ahead of ourselves, part 1
AWS CloudCorporate data center
Active
MicrosoftAD
Users &
Groups
LDAP,
Kerberos,
Referrals
Trust
VPC
CustomSAML
enabled
application
User access
AWS SSO
Custom SAML
enabled
application
Internet
SaaS
application
AWS SSO
user portal
AWS SSO: User access to business applications

Revisiting where we got ahead of ourselves, part 2
center
Active
MicrosoftAD
Users &
Groups
LDAP,
Kerberos,
Referrals
Trust
Amazon EC2
(Windows/Linux)
Amazon WorkSpaces
Amazon Chime Amazon WorkDocs Amazon WorkMail
Amazon QuickSight Amazon Connect
VPC AWS managed applications
Windows
Application
User access
AWS Directory Service: User access to windowsapplications and AWS
managed applications

Application
Infrastructure
AWS platform
AWS Organizations AWS Secrets ManagerAWS Directory ServiceIAM Amazon CognitoAWS SSO
Lifecycle
managementfor
secrets
Identity and
access
management
for your apps
& APIs
Actual Microsoft
Active Directory
as a managed
service on the
AWS Cloud
Fine-grained
access
management
for AWS
resources
Manage single
sign-on (SSO)
access to
multiple AWS
accounts and
business
applications
Central
governance and
management
for multiple
AWS accounts

Thank you!
Quint Van Deman
Find me on LinkedIn

AWS identity services - Enabling & securing your cloud journey - SEC202 - Santa Clara AWS Summit.pdf

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to AWS identity services - Enabling & securing your cloud journey - SEC202 - Santa Clara AWS Summit.pdf

Similar to AWS identity services - Enabling & securing your cloud journey - SEC202 - Santa Clara AWS Summit.pdf (20)

More from Amazon Web Services

More from Amazon Web Services (20)

AWS identity services - Enabling & securing your cloud journey - SEC202 - Santa Clara AWS Summit.pdf