AWS Identity and Access Management

As digitalisation reshapes industries, AWS has expanded identity and access management (IAM) to improve business processes, identify users accessing corporate facilities, and reduce cybersecurity risk through stronger access control. AWS IAM supports public cloud and hybrid configurations, enabling fine-grained entitlement assignment and segmented administration. Recommended segmentation includes server access, database access, key management, and backup services, as well as separating access across dev, test, and production environments. Organizations can implement access control through roles, groups, organizational units, or user attributes (e.g., department-based controls), and AWS supports both role- and group-based entitlement assignment to cover diverse patterns.

AWS also supports federation: it is SAML 2.0 compliant and can provide single sign-on (SSO) to the AWS Management Console via trusted third-party identity providers. Federation extends to API access, which is useful for third-party users accessing AWS-hosted applications through APIs. Key management has been enhanced: customers can use AWS-managed key management or bring their own customer master key to satisfy regulatory requirements. Identity management is positioned as core cloud functionality, with AWS providing a functional interface for protecting infrastructure and controlling access.

Historically, AWS IAM focused on controlling administrative access to AWS system functions; application-level access relied on Simple AD connected to on-premises AD. With AWS Directory Service for Microsoft AD plus expanded IAM, AWS can now host more comprehensive identity management, including cloud-based authentication for AD-aware applications and synchronization or extension of on-premises AD domains. AWS provides IAM users, password policies (including lockout controls and precedence-based policy profiles), roles, groups, delegated administration via delegated groups, and policy management using JSON-based policies (managed or inline, with an editor to simplify creation). MFA options include SMS and one-time passwords, with support for custom MFA approaches. Cognito enables mobile identity via user pools and identity pools supporting social and SAML-based federation. Strengths include fine-grained controls, MFA, federation, and AD integration; challenges include IAM’s focus on AWS resources rather than external apps or SaaS.

• AWS IAM provides fine-grained access control to AWS resources and services.
• AWS supports role assignments and group assignments for entitlement management.
• AWS is fully SAML 2.0 compliant and can provide SSO to the AWS Management Console via a trusted third-party identity provider.
• Federation can be used for API security management when third-party users must access applications via AWS APIs.
• Customers can use AWS key management or bring their own customer master key to AWS.
• AWS Directory Service for Microsoft AD can extend an on-premises AD domain to AWS or synchronize on-premises AD to the AWS directory.
• An AWS environment initially includes a root-user account that should be used to create administrator accounts and then not used again.
• AWS password policy controls include length, strength, expiration, history, self-service password changes, and account lockout parameters.
• AWS provides five pre-defined password policy settings with precedence levels that determine which requirement applies.
• IAM policies are evaluated with a deny-by-default approach, and an explicit deny stops further policy evaluation.

• “It is highly advisable to segment server access, database access, key management and backup services.”
• “When an AWS environment is initially established, a ‘root-user’ account is established.”
• “This account should be used to establish one or more administrator accounts and should not be used again.”
• “This obviates the need for any generic accounts so that all events are logged to the individuals that performed them.”
• “Access will normally be ‘denied-by-default’ i.e. access will be prohibited unless explicitly permitted.”
• “In any policy set, if one policy explicitly denies access no further policies will be evaluated.”
• “Roles are a simple but powerful way that AWS provides for entitlement management.”
• “The principle of ‘least privileges’ can be applied to a service account whereby the applicable role only grants access as required for the basic service.”
• “AWS provides an editor to create policies without the need to be proficient in JSON.”
• “AWS is not prescriptive as to how to deploy identity management, they provide multiple facilities and it’s up to the client to design their network configuration and plan their application security.”