Infrastructure Security services are seen as the traditional mechanisms for enforcing protection of data. But now Identity and Access Management has to be considered too to prevent illegitimate access to information, unauthorized usage of services, and tampering of data. This is why, at AWS, Identity and Access Management oriented services is global service in our portfolio. Implementing a least privileged model for your workload requires that you consider what each component must have as permissions. For example: is it better to assign an IAM role to your Compute instance or to impersonate the initial requestor with their roles and permissions? Are the attributes of the requestor important for your access control logic? Can the context of the request influence how the resource should be disclosed? Answering those questions will allow you to design and implement access control thanks to a composition of multiple mechanisms. Through this session, we will describe how a very simple web store application will benefit from implementing: identity federation, attribute-based access control, and security token exchange through the usage of the appropriate AWS services.

1. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AtlSecCon ‘22
Enforcing access control in depth with AWS
Jeff Lombardo
Sr. Solution Architect, Security Specialist
April 2022

2. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Jeff Lombardo
Senior Solution Architect / Security Specialist at AWS
Joined AWS in September 2020
Previously 15 years of expertise in Identity and Access Management,
Application Security, and Data Protection
My Moto: Give me a redirect URI and I will SSO the world

3. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What are the key
principles?
What are we trying
to solve?
Agenda
Defining Access
Control in Depth
AWS Access Control
capabilities
Are they specific?
What are the
advantages?
Example with
a 3-tier application
How can we apply
AWS capabilities for
improving security?
Starting to build
securely on AWS
Multiple resources
to help you learn
more

4. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 4
Why Access Control in
Depth is key?

5. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Any Security event includes an Access Control issue
5

6. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Disambiguate requests by
having initial requestor
identity and entitlements
shared with all tiers
Key principles of Access Control in Depth
Traceability Least Privilege
Ensure all tiers don’t have
more permissions that is
necessary for each request
Explicit Controls
Encompass context and
history in Access Control
logic to catch modern
threats and events
6
• Is this really User C
connecting at 10 PM
from Antarctica?
• Is the batch server
talking to the
Database server still a
trusted flow?
• Who,
• When,
• What,
• How,
• from where,
• for Which result

7. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 7
AWS Access Control
capabilities

8. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 8
AWS Cloud
Caption:
Amazon EC2 Amazon S3 Amazon Redshift
The classic method

9. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 9
AWS Cloud AWS account 111122223333
Caption:
Amazon EC2 Amazon S3 Amazon Redshift
The classic method

10. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 10
AWS Cloud AWS account 111122223333
Caption:
Amazon EC2 Amazon S3 Amazon Redshift
Region W
Region X
The classic method

11. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 11
AWS Cloud
AWS IAM
AWS account 111122223333
Permissions
Credential(s)
Role(s)
User(s) Group(s)
Caption:
Amazon EC2 Amazon S3 Amazon Redshift
Region W
Region X
The classic method

12. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Important points
AWS IAM Roles
• Assumed by IAM/federated users,
applications, or AWS services like
Amazon EC2 instances
• Benefits
• Security: no sharing of secrets
• Control: revoke access anytime
AWS IAM policies
• Groups of permission statements in JSON
format
• Each statement defines:
▪ A Principal in a form an AWS Resource
Name
▪ An effect (Allow or Deny)
▪ The Actions concerned
▪ The Resources concerned
▪ Optionally some fine grained Conditions
12

13. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Example
13
{
"Version": "2012-10-17",
"Statement": [{
"Sid": "1",
"Effect": "Allow",
"Principal": {"AWS": ["arn:aws:iam::111111111111:root"]},
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::mybucket",
"arn:aws:s3:::mybucket/*“
] ,
"Condition": {"Bool": {"aws:MultiFactorAuthPresent": "true"}}
}]
}

14. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 14
AWS Cloud
AWS IAM
AWS account 111122223333
Permissions
Credential(s)
Role(s)
User(s) Group(s)
Caption:
Amazon EC2 Amazon S3 Amazon Redshift
Region W
Region X
The classic method
AWS IAM Access Analyzer
AWS CloudTrail Amazon GuardDuty

15. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Analyze all the IAM
permissions to identify any
overly permissive and out-
of-zone of trust access.
Track user activity and API
usage to enable governance,
compliance,
and operational and risk
auditing of your AWS
account.
Gaining visibility
AWS CloudTrail AWS IAM Access Analyzer Amazon GuardDuty
Intelligent threat detection
and continuous monitoring
to protect your AWS
accounts and workloads.
15

16. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Let’s compare the methods
How to Authenticate Classic method
16
Users and Credentials
defined in AWS IAM
User based
long-term security
credentials
A principal through the UI
A principal through the SDK
A principal through the CLI / API
Compute instance role
only or long-term
security
credentials

17. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 17
AWS Cloud
AWS IAM
AWS account 111122223333
Permissions
Credential(s)
Role(s)
User(s) Group(s)
Caption:
Amazon EC2 Amazon S3 Amazon Redshift
Region W
Region X
The federated method
Corporate
data center
Enterprise
IAM
Capabilities
Credential(s)
User(s) Group(s)
AWS IAM Access Analyzer
AWS CloudTrail Amazon GuardDuty

18. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 18
AWS Cloud
AWS IAM
AWS account 111122223333
Permissions
Role(s)
Caption:
Amazon EC2 Amazon S3 Amazon Redshift
Region W
Region X
IdP(s)
The federated method
Corporate
data center
Enterprise
Identity
Server
Credential(s)
User(s) Credential(s)
Group(s)
AWS IAM Access Analyzer
AWS CloudTrail Amazon GuardDuty

19. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Let’s compare the methods
How to Authenticate Classic method
19
Federated method
Users and Credentials
defined in AWS IAM
User based
long-term security
credentials
Compute instance role
only or long-term
security
credentials
Enterprise defined
Users and Credentials
Compute instance role
or user based
temporary security
credentials
User based
long-term security
credentials
A principal through the UI
A principal through the SDK
A principal through the CLI / API

20. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 20
AWS Cloud
AWS IAM
AWS account 111122223333
Permissions
Role(s)
Caption:
Amazon EC2 Amazon S3 Amazon Redshift
Region W
Region X
IdP(s)
The multi-accounts method
Corporate
data center
Enterprise
Identity
Server
Credential(s)
User(s) Credential(s)
AWS IAM
AWS account 555555555555 Region W
Region X
Group(s)
AWS IAM Access Analyzer
AWS CloudTrail Amazon GuardDuty

21. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 21
AWS Cloud
AWS IAM
AWS account 111122223333
Permissions
Role(s)
Caption:
Amazon EC2 Amazon S3 Amazon Redshift
Region W
Region X
IdP(s)
The multi-accounts method
AWS IAM Access Analyzer AWS CloudTrail
Corporate
data center
Enterprise
Identity
Server
Credential(s)
User(s) Credential(s)
AWS IAM
AWS account 555555555555 Region W
Region X
AWS account 444455556666
(Root)
AWS Organizations
Organizational unit(s)
Group(s)

22. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 22
AWS Cloud
AWS IAM
Corporate
data center
AWS account 111122223333
Enterprise
Identity
Server
AWS account 444455556666
(Root)
Caption:
Amazon EC2 Amazon S3 Amazon Redshift
AWS Organizations
AWS IAM
AWS account 555555555555 Region Y
Region Z
Region W
Region X
AWS account 7777888899990000 (Security)
Organizational unit(s)
The multi-accounts method
Credential(s)
User(s) Group(s) Permissions
Role(s)
IdP(s)
Credential(s)
AWS IAM Access Analyzer
AWS CloudTrail Amazon GuardDuty

23. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 23
AWS Cloud
AWS IAM
Corporate
data center
AWS account 111122223333
Enterprise
Identity
Server
AWS account 444455556666
(Root)
Caption:
Amazon EC2 Amazon S3 Amazon Redshift
AWS Organizations
AWS IAM
AWS account 555555555555 Region Y
Region Z
Region W
Region X
AWS account 7777888899990000 (Security)
Organizational unit(s)
The multi-accounts method
Credential(s)
User(s) Group(s) Permissions
Role(s)
PermissionSets
AWS Single Sign-On
IdP User(s) Group(s)
Temp. security
credential AWS IAM Access Analyzer
AWS CloudTrail Amazon GuardDuty

24. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Let’s compare the methods
How to Authenticate Classic method
24
Federated method Multi-Accounts method
A principal through the UI
A principal through the SDK
Users and Credentials
defined in AWS IAM
User based
long-term security
credentials
Enterprise defined
Users and Credentials
Compute instance role
or user based
temporary security
credentials
User based
long-term security
credentials
User based
temporary security
credentials
Compute instance role
or user based
temporary security
credentials
Enterprise defined
Users and Credentials
A principal through the CLI / API
Compute instance role
only or long-term
security
credentials

25. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 25
Example with
a 3-tier application

26. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Let’s take a simple example
26
User A
User B
User C
Web
Server
Amazon
Redshift
AWS account 444455556666 (Root)
AWS account 111122223333
AWS SSO AWS Organizations
AWS account 7777888899990000 (Security)
AWS IAM Access Analyzer
AWS CloudTrail Amazon GuardDuty
AWS Cloud
Corporate
data center
Enterprise
Identity
Server
AWS IAM
Permissions
Role(s)

27. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Enforcing key principles
Virtual table
Virtual table
X
X
X
X
X
Groups and
permissions
Amazon Redshift
AWS IAM
AWS IAM
Roles and
policies
Temp. DB
credential
Enterprise
User accounts
Groups and
permissions
AWS SSO
IdP
Permission
Set
Enterprise
Identity Server
Amazon EC2 workload
Application
code with
JDBC driver
User A
27

28. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Enforcing key principles
Virtual table
Virtual table
X
X
X
X
X
Groups and
permissions
Amazon Redshift
AWS IAM
AWS IAM
Roles and
policies
Temp. DB
credential
Enterprise
User accounts
Groups and
permissions
AWS SSO
IdP
Permission
Set
Enterprise
Identity Server
Amazon EC2 workload
Application
code with
JDBC driver
User A A
B
C
SAML token
Credential(s)
28

29. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Enforcing key principles
Virtual table
Virtual table
X
X
X
X
X
Groups and
permissions
Amazon Redshift
AWS IAM
AWS IAM
Roles and
policies
Temp. DB
credential
Enterprise
User accounts
Groups and
permissions
AWS SSO
IdP
Permission
Set
Enterprise
Identity Server
Amazon EC2 workload
Application
code with
JDBC driver
User A
D
A
B
C
E
Temporary security
credential
SAML token
29

30. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Enforcing key principles
Virtual table
Virtual table
X
X
X
X
X
Groups and
permissions
Amazon Redshift
AWS IAM
AWS IAM
Roles and
policies
Temp. DB
credential
Enterprise
User accounts
Groups and
permissions
AWS SSO
IdP
Permission
Set
Enterprise
Identity Server
Amazon EC2 workload
Application
code with
JDBC driver
User A
D
A
B
C
E F
G
Temp. security
credential
Temp. DB
credential
30

31. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Enforcing key principles
Virtual table
Virtual table
X
X
X
X
X
Groups and
permissions
Amazon Redshift
AWS IAM
AWS IAM
Roles and
policies
Temp. DB
credential
Enterprise
User accounts
Groups and
permissions
AWS SSO
IdP
Permission
Set
Enterprise
Identity Server
Amazon EC2 workload
Application
code with
JDBC driver
User A
D
A
B
C
E F
G
H
I
Temp. DB
credential
Data
31

32. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Controlling key principles enforcement
AWS CloudTrail AWS IAM Access Analyzer Amazon GuardDuty
32
Traceability Least Privilege Explicit Controls
• Authenticated through a
Trusted IdP
• Authorized Assume role for
federated subject
• Authorized DB credential
creation for federated
subject
• Access to data through DB
user
• Identification of * based
principals, conditions,
and/or resources
• Identification of never used
permissions
• Identification of external
trust relationship
• Evaluation of traffic against
IoCs
• Evaluation of current
operations against ML
generated baselines

33. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Q&A
Let’s pause for a second
33

34. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. 34
Starting to build on AWS

35. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Get on-demand convenience with Digital Training
Get started at aws.training
Over 500 free training courses
Cost-effective
Search by role, domain, specific
services, and level of expertise
Flexible
Access all AWS Classroom Training
courses virtually to bring the learning
experience to you; anytime, anywhere
Convenient

36. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Re:Invent 2021 recap
36
https://www.youtube.com/watch?v=4J8REvs7zaY https://www.youtube.com/watch?v=pKPiPplJNak

37. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security Workshops
Get started at awssecworkshops.com

38. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Thank you!
38
Please, don’t forget to fill
the survey for this session:
https://eventbox.dev/survey/0C095J8