AWS Service Management Insurance policies. Setting controls on the organizational… | by Teri Radichel | Cloud Safety | Jan, 2023

January 19, 2023

5

Setting controls on the organizational stage

This can be a continuation of my sequence on Automating Cybersecurity Metrics.

As a reminder I’ve lately been contemplating tips on how to shield domains migrated to a single AWS account in a company that’s devoted for that function. I’ve thought-about the professionals and cons of utilizing numerous IAM capabilities and the way somebody would possibly escalate privileges to get to the sources in that account.

Within the final publish, I reiterated The Dry Precept (Don’t Repeat Your self). I’ve written about it a number of instances however determined to summarize it in a single publish:

That idea is relevant to at least one final AWS assemble we will use in our IAM structure to assist shield our sources and supply governance throughout our group. We cloud disallow entry to Route 53 area administration capabilities in every account for every consumer, group, or function. However we’ve another choice that permits us to implement this coverage in a single place, one time, globally.

AWS Service Management Insurance policies (SCPs) present the flexibility to create a coverage on the organizational stage that applies throughout all of your AWS accounts.

As a substitute of writing code again and again to limit entry, we will write a coverage that applies throughout the group to restrict actions throughout the board with a number of minor exceptions.

Deny all however one function to carry out sure actions

AWS gives the next instance of an SCP that denies explicit actions to all however a single Administrative function.

We are able to implement MFA to imagine the function.

We are able to leverage the ideas on this instance coverage to require MFA to imagine the function.

Deny account root consumer from taking unauthorized actions

We are able to additionally deny entry to the foundation consumer of the AWS account:

Stop removing of account from group

The opposite factor somebody may attempt to do to get round restrictions can be to take away the account from the group. We are able to stop that as properly.

Keep away from utilizing regularly energetic classes to carry out delicate actions

We have to determine is who, precisely, goes to be allowed to handle domains. We wish to write an SCP that permits anybody besides that particular function from accessing the account or managing domains.

I’m going to arrange a distinct consumer and function to handle domains and disable the automation keys when not in use.

Limiting who can change SCPs

We now have the identical complication with SCPs that we’ve with different IAM permissions. Anybody who has permission to alter the insurance policies can change or take away them to go well with their very own wants. I’m going ot use a separate consumer from my ROOT consumer to deploy SCPs.

Automated deployment of SCPs by way of CloudFormation

It looks like a few of the documentation I referenced earlier is wrong as a result of I discovered a CloudFormation useful resource that seems to create an SCP:

Subsequent steps

It looks like these are the following steps (if these are all doable):

Create or select a principal that’s allowed to deploy SCPs.
Create or select a principal that’s allowed to handle domains (transfers, register, deregister).
Create an SCP that denies all however our SCP admin to create, modify or delete SCPs.
Create an SCP to require MFA for all function assumptions for customers.
Create an SCP that denies all however our area administrator principal carry out the Route 53 area actions and solely within the domains account.
Create an SCP to disclaim PassRole to any consumer as a result of as famous we presently don’t want that permission and it poses a danger. (We’re utilizing roles with the CLI and requiring MFA.) We are able to restore this permission if and after we want it later.
Create a PermissionBoundary that solely permits customers to alter their very own password, handle their very own MFA keys, or add their very own developer keys. *
Create an SCP to Deny anybody however our IAM Admin from utilizing the CreateUser permission and might solely add a consumer with the desired PermissionBoundary.
Restrict root account actions.
Stop the account from being faraway from the group to bypass the principles.

* We might have a difficulty with this one in relation to our automation accounts however we’ll cross that bridge after we come to it.

Properly, that’s the concept, however we’ll must see how that works out after we try and implement it.

Teri Radichel

In case you favored this story ~ clap, comply with, tip, purchase me a espresso, or rent me 🙂

Medium: Teri Radichel
Electronic mail Checklist: Teri Radichel
Twitter: @teriradichel
Twitter (firm): @2ndSightLab
Mastodon: @teriradichel@infosec.trade
Put up: @teriradichel
Fb: 2nd Sight Lab
Slideshare: Displays by Teri Radichel 
Speakerdeck: Displays by Teri Radichel
Books: Teri Radichel on Amazon
Recognition: SANS Distinction Makers Award, AWS Hero, IANS School
Certifications: SANS
Schooling: BA Enterprise, Grasp of Sofware Engineering, Grasp of Infosec
How I acquired into safety: Girl in tech
Purchase me a espresso: Teri Radichel
Firm (Penetration Exams, Assessments, Coaching): 2nd Sight Lab
Request providers through LinkedIn: Teri Radichel or IANS Analysis