Define access requirements

Each component or resource within your workload must be accessed by administrators, end users, or other components. To manage permissions effectively, it is essential to clearly define access requirements for every resource and component. This involves determining who or what needs access, selecting the appropriate identity type, and implementing secure methods of authentication and authorization to control access.

1. Identify who or what needs access: Determine which users (administrators, end users) or machine identities (services, applications) require access to each component or resource in your workload. Ensure that only necessary entities are granted access, following the principle of least privilege.
2. Define access types and permissions: Clearly define the type of access each identity requires (e.g., read, write, execute). Specify what actions each user or component is allowed to perform on a resource. This helps avoid over-privileged access and ensures tight security control.
3. Choose the appropriate identity type: Use human identities for administrators and end users who interact directly with the system, and machine identities (e.g., IAM roles, service accounts) for components or services that require programmatic access to AWS resources.
4. Select the authentication method: Implement strong authentication methods to validate access. For human identities, use multi-factor authentication (MFA) to add an extra layer of security. For machine identities, use short-lived credentials such as AWS Security Token Service (STS) tokens or IAM roles.
5. Apply authorization controls: Use AWS Identity and Access Management (IAM) policies, service control policies (SCPs), or attribute-based access control (ABAC) to define and enforce who is authorized to access specific resources. These policies help ensure that access is controlled at a granular level.

Supporting Questions:

• How do you determine who or what needs access to specific components in your workload?
• What criteria do you use to define access types and permissions for each identity?
• What methods of authentication and authorization are applied to manage access?

Roles and Responsibilities:

Identity and Access Management Specialist:

• Responsibilities:
  • Define access requirements for users and machine identities based on the principle of least privilege.
  • Design and implement authentication and authorization mechanisms to control access to AWS resources.
  • Regularly review and update access control policies based on changing workload requirements.

Cloud Administrator:

• Responsibilities:
  • Apply IAM roles and policies to enforce access control for both people and machine identities.
  • Ensure authentication methods, such as MFA and temporary credentials, are properly configured and maintained.
  • Monitor and audit access to resources to ensure compliance with access requirements.

Artefacts:

• Access Control Policy Documentation: Detailed policies outlining the access requirements for users and machine identities, including permissions and access methods.
• Authentication Configuration Logs: Records of the authentication methods implemented for various identities, such as MFA settings and credential rotation schedules.
• Audit Reports: Logs from AWS CloudTrail or other monitoring tools that track access to resources, providing a history of who accessed what and when.

Relevant AWS Services:

AWS Identity Services:

• AWS Identity and Access Management (IAM): Manage permissions for people and machine identities by creating and applying IAM policies to control access to AWS resources.
• AWS Security Token Service (STS): Issue temporary credentials for secure, short-lived access to AWS resources, minimizing the risk associated with long-term credentials.
• AWS Single Sign-On (SSO): Centralize access management for users across AWS accounts and applications, simplifying user authentication and authorization.

Monitoring and Compliance Services:

• AWS CloudTrail: Provides visibility into all access attempts and actions performed on AWS resources, helping you monitor and audit permissions usage.
• AWS Config: Monitors and records configuration changes to IAM policies, ensuring compliance with defined access requirements.