AWS IAM Administration and Security

  • Introduction to IAM Identity Creation

    • In AWS, avoid using the root user for production and training.
    • The root user cannot be restricted, deleted, or recreated.
    • Best practice: Create an IAM user for regular account access, with full permissions as needed.

  • Steps to Set Up IAM Admin User

    1. Access IAM Console:
    • In AWS Management Console, search for "IAM" and click to open the IAM console.
    • If prompted with a new UI notification, simply close it.
    1. IAM Sign-In URL:
    • The sign-in URL generally follows the format:
      https://[AccountID].signin.aws.amazon.com/console
    • Create a user-friendly alias to replace the Account ID (e.g., general-[YourName]).
    • Ensure the alias is unique and contains the word "general".

  • Creating the IAM Admin User

    1. Go to Users Section:
    • Click "Users" and then "Add users".
    1. User Details:
    • Input the username, e.g., IAM admin (should be unique within the account).
    1. Access Type:
    • Select “AWS Management Console access.”
    • Set a custom password and choose whether to require password reset (uncheck for convenience).
    1. Set Permissions:
    • Click "Attach existing policies directly".
    • Locate and attach the AdministratorAccess policy to grant full control over the account.
    1. Review and Create User:
    • Review the settings and click to create the user.

  • Testing IAM User Access

    1. Sign-In URL:
    • Copy the sign-in URL into a safe place. This will be used for future logins.
    1. Login Process:
    • Open the sign-in URL, enter the IAM admin username and password.
    • Verify being logged in as an IAM user instead of root () using the console dashboard.

  • Setting Up MFA for IAM Admin User

    1. Navigate to My Security Credentials:
    • Click on the dropdown and choose "My Security Credentials".
    1. Assign MFA Device:
    • Click on "Assign MFA Device" -> Select "Virtual MFA device".
    • Scan the QR code with your authenticator app to create a new entry (don’t reuse existing).
    1. Enter MFA Codes:
    • Input two consecutive codes from the authenticator app and click on "Assign MFA".

  • Testing MFA Access

    1. Log Out:
    • Sign out of the IAM user session.
    1. Login Again:
    • Use the sign-in URL, enter username and password followed by MFA code to log back in.

  • Summary of Actions Taken

    • Established an IAM admin user separate from the root user for the general AWS account.
    • Set up Multi-Factor Authentication (MFA) for enhanced security of the IAM admin account, creating two distinct entries in the authenticator app (one for the root and another for IAM admin).

  • Conclusion:

    • From this point forward, utilize the IAM admin identity for activities in the AWS account, following best security practices.