Use temporary credentials

When authenticating users or machines, it’s best to use temporary credentials instead of long-term credentials to reduce or eliminate risks, such as credentials being inadvertently disclosed, shared, or stolen. Temporary credentials provide a limited-time access window and are automatically revoked after use, minimizing the exposure risk.

1. Use IAM roles with temporary security credentials: Assign IAM roles to users, services, and applications to enable them to assume temporary security credentials. These credentials are generated dynamically and expire after a defined period, reducing the risk of credential compromise.
2. Leverage AWS Security Token Service (STS): Use AWS STS to issue temporary credentials for trusted users and machines. STS can provide short-lived access to AWS resources, ensuring that credentials automatically expire after use, enhancing security.
3. Avoid using long-term access keys: Where possible, avoid the use of long-term access keys for both human and machine identities. Long-term keys can be accidentally disclosed, shared, or stolen, leading to unauthorized access. Replace them with temporary credentials wherever feasible.
4. Automate credential issuance and rotation: Use automation to issue and rotate temporary credentials, especially for machine identities. Automation ensures that credentials are short-lived and continuously refreshed, reducing manual errors and the likelihood of using outdated credentials.
5. Use AWS Cognito for temporary access in applications: For applications requiring user authentication, AWS Cognito can provide temporary credentials that grant access to AWS resources. This solution is particularly effective for mobile and web applications, providing secure, temporary access without exposing long-term credentials.

Supporting Questions:

• How do you manage the issuance and expiration of temporary credentials for users and machines?
• What processes are in place to replace long-term credentials with temporary credentials?
• How do you automate the rotation and revocation of temporary credentials in your environment?

Roles and Responsibilities:

Identity and Access Management Specialist:

• Responsibilities:
  • Ensure that all access to AWS resources is done using temporary credentials through IAM roles or AWS STS.
  • Implement policies to prevent the use of long-term access keys in AWS environments.
  • Monitor the use of temporary credentials and ensure their proper expiration and rotation.

Cloud Security Engineer:

• Responsibilities:
  • Automate the issuance and rotation of temporary credentials for machine identities.
  • Integrate AWS Cognito or similar tools for providing temporary access to users in applications.
  • Ensure proper logging and monitoring of the use of temporary credentials to detect any anomalies.

Artefacts:

• STS Credential Issuance Logs: Logs that track the generation and usage of temporary credentials issued by AWS STS.
• IAM Role Configuration Documentation: Documentation outlining the setup and use of IAM roles for temporary credentials.
• Credential Expiration Reports: Reports that verify the proper expiration and revocation of temporary credentials, ensuring compliance with security policies.