Amazon Web Services are easy and incredibly fun to use. Need to spin up a web server and Redis cluster? No problem! But how do you protect the AWS account from unauthorized use? Well, IAM users and MFA of course!
The AWS Certified Solutions Architect exam guide covers IAM users and groups, as well as enabling MFA for your IAM user accounts, in Chapter 6.
The exercises at the end of the chapter have you create an IAM group, an IAM user, and then enable MFA for your newly created IAM user (in exercise 6.6). I've really enjoyed going through the exam guide specifically due to the chapter review quizzes (answers with explanations are in the back of the book) and the exercises.
Here are the steps that I used for creating an IAM group and user (using exercises 6.1 and 6.3 as the motivator, and following along in the very easy to use AWS console interface).
Creating an IAM Group:
- Go to the IAM service in the AWS console.
- Click the "Groups" console item.
- Click the "Create New Group" button to start the group creation wizard.
- Enter your group name in the "Group Name' text box and then click "Next Step". I chose "Administrators" as the AWS exam guide suggested.
- In the Attach Policy step, the exam book tells you to click the "IAMFullAccess" policy check box. The "IAMFullAccess" policy gives the group members full access to IAM via the AWS Management Console. The AWS online documentation for creating your first user and group has you select the "AdministratorAccess" policy - which will give you full access to AWS services and resources. I chose the "AdministratorAccess" policy.
- The last step is to review your proposed settings. Click the "Create Group" button. You'll be returned to the "Groups" list view, and you'll see your new group.
Creating an IAM User:
- Go to the IAM service in the AWS console.
- Click the "Users" console item.
- Click the "Add user" button to start the user creation wizard.
- Enter a user name in the "User name" text box.
- In the "Select AWS access type" section, click the "AWS Management Console access" check box. This will cause the "Console password" options to appear.
- Select the "Custom password" option, and enter a password.
- The "Require password reset" check box is checked by default. If you are creating a user for someone else to use, then it is a good idea to keep this option checked.
- Click the "Next: Permissions" button.
- On the "Permissions" step of the wizard, click the "Add user to group" image if it is not already highlighted (this is the default selection).
- Check the checkbox for the group you created above.
- Click the "Next: Review" button.
- Click the "Create user" button. You'll be taken to "Success" page where you can see the user listed. It will contain a signin link that includes your AWS user ID as part of the url. ie, https://123456789012.signin.aws.amazon.com/console. You'll also be able to download the user credentials via a download button. The success page mentions that you can create new credentials at any time. The credentials file lists the user name and the signin link.
Enable MFA for an IAM user:
- Go to the IAM service in the AWS console.
- Click the "Users" console item.
- Click on the user name for the user you would like to enable MFA.
- Click on the "Security credentials" tab.
- Click on the edit icon for "Assigned MFA device".
- Choose "A virtual MFA device" in the "Manage MFA Device" pop up dialog, and then click the "Next Step" button.
- You're instructed to install an AWS MFA-compatible application on the device of your choice - PC, smartphone, etc. There is a link in the dialog that will take you to a list of MFA-compatible applications. Install one of the compatible applications. I used the smart phone option, and installed the Google Authenticator application.
- Click the "Next Step" button.
- A QR code is displayed in the AWS "Manage MFA Device" pop up dialog, and you are instructed to use your smart phone to scan the code.
- If you're using the Google Authenticator, then a 6 digit code is displayed on your device, and is refreshed every 30 seconds.
- You're instructed to enter two sets of the 6 digit codes, and then told to click "Activate Virtual MFA"
I highly recommend the exam guide even though it is starting to get a bit dated. The book gives you a condensed and comprehensive look - and the exercises really help drive home the material. I found that some of the exercises were a bit sparse in information, and no longer match what the AWS console shows you, but it is close enough that you can figure things out without getting lost.
The experience was very fun, and the end result is that I now have a much more secure admin account!
