Establish emergency access process

In the event of an issue with your centralized identity provider, it’s crucial to have an emergency access process in place to ensure that you can still access your workloads and critical resources. This process should allow administrators to bypass normal authentication mechanisms in a secure and controlled manner, ensuring minimal disruption while maintaining security.

1. Define emergency access roles: Establish predefined emergency access roles with the minimum necessary permissions required to access and manage workloads during an outage or failure of the identity provider. These roles should be highly restricted and used only in emergency situations.
2. Use break-glass accounts: Set up “break-glass” accounts with the appropriate permissions to access critical systems in case of an emergency. These accounts should not be tied to your centralized identity provider and should be secured with strong authentication methods, such as multi-factor authentication (MFA).
3. Store credentials securely: Ensure that credentials for break-glass accounts or emergency access roles are stored securely, such as in a hardware security module (HSM) or a highly restricted vault, accessible only to authorized personnel. These credentials should only be retrieved during emergencies.
4. Log and audit emergency access: Any use of emergency access should be logged and audited. Use AWS CloudTrail and other monitoring tools to ensure that all actions performed during emergency access are tracked and reviewed afterward to ensure compliance and identify any potential misuse.
5. Test the process regularly: Regularly test the emergency access process to ensure that it works as expected and that the designated personnel know how to execute it. Testing should include scenarios where the centralized identity provider is unavailable, and the break-glass accounts need to be used.
6. Revoke access after resolution: Once the emergency situation has been resolved, immediately revoke any temporary or break-glass access that was granted. Ensure that any changes made during the emergency are reviewed and corrected, if necessary, to align with security policies.

Supporting Questions:

• What are the predefined emergency access roles, and how do you ensure they have the least privilege necessary?
• How are break-glass accounts secured, and who has access to their credentials?
• How do you log and audit the use of emergency access to ensure compliance?

Roles and Responsibilities:

Security Officer:

• Responsibilities:
  • Define and maintain emergency access roles and ensure they follow least privilege principles.
  • Regularly audit and review any emergency access incidents to ensure compliance with security policies.
  • Securely store and manage credentials for break-glass accounts, ensuring limited access.

Cloud Administrator:

• Responsibilities:
  • Implement break-glass accounts and ensure they are properly configured for emergency access.
  • Test and document the emergency access process to ensure it works as expected during identity provider outages.
  • Revoke emergency access after incidents and review any actions taken during the process.

Artefacts:

• Emergency Access Procedures: Detailed documentation of the steps to follow in case of an identity provider outage, including how to use break-glass accounts.
• Break-Glass Account Credentials Management: Secure storage logs and policies outlining how and where credentials for emergency accounts are stored and accessed.
• Access Logs and Audits: Logs from AWS CloudTrail or other monitoring tools that record any actions taken during emergency access, ensuring compliance and transparency.

Relevant AWS Services:

AWS Identity Services:

• AWS Identity and Access Management (IAM): Use IAM to create predefined emergency roles with the least privilege necessary to manage workloads in case of identity provider failure.
• AWS Secrets Manager: Securely store credentials for break-glass accounts and manage their access in a controlled and auditable manner.

Monitoring and Compliance Services:

• AWS CloudTrail: Provides comprehensive logging of all actions taken during emergency access, ensuring full transparency and auditability of break-glass account usage.
• AWS Config: Tracks configuration changes made during emergency access to ensure that any necessary adjustments align with organizational security policies.