- Okay, so now let's review some best practices
within AWS identity and access management.
It's really important that we leverage groups,
especially when we have a large number of users.
It just makes life easier when you go to
assign permissions to different groups of people.
Grant lease privilege, meaning that,
give a user enough permission to do what they need to do,
but not so much that they can be dangerous.
We need to implement strong password policies,
including, allow them to be long.
Make them use multiple types of characters,
like numbers and special characters.
Deny the last three passwords being reused.
In a larger environment, it's also really helpful,
and it adds that extra layer of security
by leveraging multiple accounts.
So divide your organization into multiple accounts.
Whether it be development versus production,
or one business unit and another business unit.
It doesn't really matter, but leverage those
multiple accounts, and leverage roles
for cross-account access.
If you want to add another additional layer of security,
use deny statements, because again as we've talked about,
deny statement, the way that the evaluation logic works,
deny statement can not be overwritten by an allow.
So using deny statements just means that you have
extra guard rails, that no matter what,
that user will never be allowed to do something
unless you go in and remove that deny statement.
Never share your credentials.
When you create access keys, user names and passwords,
don't share them, don't email them, don't print them.
Don't put them into your code repositories.
And again, leverage those multiple accounts.
Now in regards to our master account,
when you first create your AWS account,
that initial email and password
is going to be your master account.
It's considered root, or if you're a windows user
it's considered administrator.
It has an implicit allow all that can not be changed.
You have no control over the permissions
of that root account.
It's allowed to do anything on any resource
at any time, from anywhere.
So, it means that that account is incredibly powerful,
and incredibly dangerous if that account is compromised.
So, we need to protect that master account
at all costs, and I say that because companies
literally have gone out of business by allowing
their master account to be compromised.
Hackers have gone in and hijacked those credentials.
They've asked for ransom in some cases,
and in other cases they have deleted
production resources to a degree that caused
that business to go completely insolvent.
So, never use it for day-to-day.
The master account will come with default access keys.
We want to delete those, so that they can't be compromised.
We want to enable multi-factor authentication
with a physical key fob, not a virtual one
on your cell-phone or your smart phone,
but a physical key fob that you then lock in a safe.
And I'm not kidding on that point.
It's so incredibly important to protect
that master account at all costs.
I do that with my own business, and I've done that
for clients of mine by enabling MFA
and locking it in a safe.
Another thing that you should do,
is go and read the security whitepaper.
It's probably one of the most popular
whitepapers available on the Amazon website,
and you can see it here at the link.
So again, protect that master account at all costs,
and be sure to read the security whitepaper.