Hi, welcome to 'This is My Architecture.' My name is Andrea,
and I'm here with Michael from General Electric.
-Hi Michael, welcome to the show. -Hi, thank you.
So what does your team do?
So I work on the cloud team at GE
and we oversee all the cloud accounts in the company.
Wonderful, so we're going to talk about virtual multi-factor authentication.
For those viewers who don't know what that is, describe it.
Kind of the past couple of years, there's been a big precedent, it seems,
that all of your-- Every--
You know, your Facebook, your Instagram,
all that needs to have those 2FA so you don't get hacked.
So the same thing goes with your Amazon account.
We want to make sure,
especially for the root account, which has full access to everything,
that, you know, that's locked down and secure.
So we ensure that we have virtual MFA on all of our root accounts.
Also it's kind of part of keeping compliant within GE.
Wonderful. This is very interesting architecture
and it runs on AWS.
So let's dive straight to it.
I'm a user. I need access to an account.
What do I do?
Okay, yeah so,
you're going to go into API Gateway, you're going to have an API key.
And you're going to put in the account ID you want to get access to
and you're going to point out a reason why you want to get access.
That's going to get sent from API Gateway, which is going to go trigger a Lambda,
and that Lambda is going to go validate the request,
make sure everything looks fine,
and then that's going to kick off a Step Function workflow.
And then this is our approval workflow, so that's going to go through--
It's going to log the request down to Dynamo.
So it'll request information
and then it's also going to kick off an email,
via SES, to the approvers. -Okay.
When you said validate?
So Lambda validates if it's correct.
How does it do the validation?
Yeah, so part of the security of this
is that each request is tied to the person who submitted it.
So at the end of this, it's going to generate a request ID.
And that's going to get returned back to the user.
That request ID is tied to your API key.
So if you give that request ID to your coworker, it won't work.
Let's dive straight into Step Functions.
So what is the process that is triggered?
And is it purely Lambda based?
Yeah, so the Lambda is going to go kick off the Step Function workflow.
And that's going to go send out the email.
And then there's-- We have some timeouts set in there as well,
so you have, let's say, 24 hours to approve,
after which the request is going to get canceled.
And then after approval,
the user has, let's say, another 24 hours
to request the first readout.
Those readouts-- As soon as you request the first one,
you have fifteen minutes to read out as many--
Or up to six tokens.
What do you store in DynamoDB?
What, specifically, do you track?
Basically all information about the request
like your IP, your user agent,
who-- like the name of the person, the email of the person.
And then we're going to track who approved it,
all that, just for-- So we can go back and track
you know, if anything was approved,
we can go back and see who approved it, why, when, all that information.
And then we can give that, if we need to, to our security team.
Wonderful. The approver approves it.
Where is that token generated?
Prior to all this, the account was added to the system,
and all the secret hashes are stored down here in Secrets Manager.
So if I want to go, let's say, do a readout of one of these,
I'm going to go put in my account ID.
Or I'm going to put in my request ID.
And then that's going to go over to Lambda here,
which is going to, again, look at Dynamo and say, is this approved?
If so, you know, that comes back
and gives the information about the request.
And then this is going to go down into secrets manager.
It's going to fetch and decrypt that secret.
And then it's going to generate the one-time, six digit code.
And it's going to turn that back to the user.
Okay. Very clever.
How do you ensure security?
How do you monitor, track?
Yeah, so like I said before,
we have basically a full audit table of every request.
In addition, every time a request is-- Someone does a readout,
that generates a CloudWatch event, which is then sent,
via an event bridge over to our security team.
This is a serverless architecture
and I see many interesting trends here.
Tell me about the value
or, you know, the benefits that you achieved
through deploying it through serverless.
Yeah, so prior to all this, and, you know, prior to having to work remotely,
we were storing all these on those little hardware MFAs,
which, as you get more and more and as time goes on,
they tend to get out of sync.
So you have to go in--
One, you have to like store them in a safe.
And, you know, if you have binders and binders of that, that starts to add up.
You need to have a process to go get those, physically.
And it was just becoming untenable to do that, especially at scale.
So we converted all those over to a virtual process,
so now, you know, that we're working remotely
we can go from anywhere in the world
and request a token to get into an account.
That's wonderful, thank you so much for walking us through this architecture.
This highly secure, virtual, multi-factor authentication platform
that you've built on AWS. Very unique.
-And thank you again for being on the show. -Thank you.
And thank you for watching 'This is My Architecture.'