[Recipes] Setting Up Basic First Time Security Tasks in IAM Dashboard

Submitted by heartin on Sat, 12/02/2017 - 20:13

Problem:

After you create your account in AWS, you will need to do some basic security steps to secure your account.

Solution Summary:

After you create a new account, you need to do some basic security steps such as: activate MFA, create IAM User and group, create password policy.

Prerequisites:

It would be good to read at least first three notes from the book getting-started-aws-part-2-security-basics-iam.

Solution Steps:

After loggin in for the first time, you have to to go to the IAM page and you need to complete all items under security status:

Task 1 should be already completed by now.

Task 2 - Activate Multi Factor Authentication (MFA) on your root account

To activate a virtual MFA device, you must first install an AWS MFA-compatible application on the user's smartphone, PC, or other device. For Android phones, you can install Google Authenticator along with Barcode Scanner.

Steps:

Click ‘Activate MFA on your root account’
Click ‘Manage MFA’
Select ‘A Virtual MFA Device’
Click Next on the message for installing MFA-compatible application, if you have installed Google Authenticator along with Barcode Scanner.
Scan the barcode shown in screen using Google Authenticator. Enter two consecutive codes.
The MFA device was successfully associated.

Task 3 - Create individual IAM users

Create IAM users and restrict them only the permissions they need. The root account provides unrestricted access to your AWS resources.

Steps:

Click on ‘Manage Users’
Click on ‘Add User’
Enter Username and Access Type (Programmatic access and/or AWS Management Console access). Programmatic access enables an access key ID and secret access key for the AWS API, CLI, SDK, and other development tools. Select both options for Access Type and leave other options as is.
Leave all options as is on further screens, clicking next until the end.
You will see the success message asking to download to credential csv.
Download credentials.csv.You can also email instructions.

Success message has below text:

You successfully created the users shown below. You can view and download user security credentials. You can also email users instructions for signing in to the AWS Management Console. This is the last time these credentials will be available to download. However, you can create new credentials at any time.

Users with AWS Management Console access can sign-in at: https://<>.signin.aws.amazon.com/console.

Now you can go back to IAM dashboard by clicking on dashboard on the sidebar and refresh page to see the updated page.

Login With Custom URL

Customize your user signin link (available in the main page) by clicking on the customize link alongside it.
Logout and login with a user created in previous step using the customized login link.

Note: This is not a checklist requirement that needs to be completed, but good to do always.

Task 4 - Use groups to assign permissions

Click on ‘Manage Groups’
Click on ‘Create New Group’
Give a group name (e.g. development)
Select one or more policies to attach (e.g. IAMUserChangePassword).
Review the information, then click Create Group.

Now you can go back to IAM dashboard by clicking on dashboard on the sidebar and refresh page to see the updated page.

Task 5 - Apply an IAM password policy

Go to ‘Account Settings’ page from left sidebar.
Select appropriate options for Password Policy.
Click on ‘Apply Password Policy’

Final Security Status

Now you can go back to IAM dashboard by clicking on dashboard on the sidebar and refresh page to see the updated page. You should now see all Security Status Items as green.