[Music]
hello I'm Frank a cloud support engineer
here at the AWS Sydney office sometimes
customers asked me how can I protect my
Amazon s3 buckets many customers with
their own AWS accounts want to give AWS
Identity and Access Management iam users
in other AWS accounts access to their s3
buckets but are understandably nervous
about protecting data in those buckets
in this video we cover how to allow
other accounts access to your buckets
while also requiring that multi-factor
authentication or MFA be used before
certain API calls can be made such as
adding and deleting resources from a
bucket let's get started we have two
accounts the trusting account which
contains the s3 bucket and the trusted
account that contains the users that
want to access that bucket in the
trusting account we use a bucket policy
that restricts certain API call types
based on whether or not the user has
authenticated with MFA in the trusted
account we set up our users to obtain
temporary security credentials using MFA
and the AWS security token AWS STS API
method get' session token we then use
these temporary credentials to make API
calls against a specific folder in the
protected bucket in the trusting account
we can do this part using the AWS
command-line interface CLI
here we are logged into the console in
the trusted account in this count we're
going to go to the iam console
to go to users and we'll see that we
already have a user set up called Bob
currently Bob doesn't have any
permissions attached to his user account
the first thing we need to do is set up
MFA access for this user so we'll go to
the security credentials tab and click
on the pencil icon for a signed MFA
device in this case we're going to use a
software MFA device we'll click next
step
then we'll scan the barcode using your
preferred MFA software and then we'll
enter two successive authentication
codes to get this user setup
with two successive codes entered will
now click activate virtual MFA
successfully assigned an MFA device to
this user now to follow best practices
rather than assign permissions directly
to Bob what we're going to do is add Bob
to a group so we've created a group
called s3 users and we're going to
select add user to this group and select
the user Bob
now if we have a look at the permissions
assigned to this group importantly it
has the Amazon s3 full access policy
attached to the group
Bob firstly needs the permissions in his
own account to make s3 API calls in
addition in the trusting account you'll
see soon that when we set up the bucket
we've also set up a bucket policy with
certain restrictions that will allow Bob
to access folders in that bucket notice
that we've also assigned to get
sessiontoken policy to this group this
particular policy allows users in the
group to make an API call for STS get
session token
this will allow Bob to make the relevant
API call and obtain temporary security
credentials which he will then use to
access the bucket we've now configured
our user in the trusted account let's
head on over to the trusting account
here we are logged in to the console of
the trusting account here we're going to
go to the s3 console
here we are in the s3 console in the
trusted account we're now going to
select the bucket that we've created
that Bob will be accessing
here we are in the relevant bucket let's
click on the permissions tab and then
click on bucket policy
we can see that indeed a bucket policy
has already been applied to this
particular bucket let's have a quick
walk through and see what this bucket
policy is doing the first statement
block effectively deniers access unless
the user has authenticated using MFA if
the user has MFA then the second
statement will come into effect because
the first one will not match the second
statement is allowing the user Bob
access to the bucket so in this case
we're specifically interested in
protecting a folder inside this bucket
called tax documents so the user must be
authenticated with MFA to gain access to
that folder otherwise the user will be
able to access other locations in the
bucket but not the protected location
now we've set up our bucket and our
bucket policy let's head back over get
some temporary credentials for this user
and test our work here we are in a
command-line session using the AWS CLI
tools we've gone ahead and set up a
profile for Bob we're now going to call
AWS STS get session token' to get some
temporary credentials that Bob will then
use to make API calls against the
protected bucket to make this call we're
using Bob's access keys and secret keys
that we created earlier these are the
static long-term credentials that are
associated with the user Bob let's go
ahead and enter in a token code
see that we've already specified the
serial number of the MFA device in this
case it is actually the AR n of that
device which we created earlier in the
AWS console
as a result of making this API call
we're returned a new set of credentials
and these are temporary credentials the
first part of the information we can see
is that we have a secret access key next
we have a session token and finally we
have an expiration and an access key ID
we're going to take the secret access
key the session token and the access key
ID and we're now going to put these into
environment variables which we will then
use when we make future API calls
against the bucket let's go ahead and do
that now and in a moment I'll show you
what that looks like once you've created
them okay so we're still in the terminal
and we've just obtained our session
credentials as you saw what we've done
now is exported them to environment
variables in their shell session so
let's just have a quick look at what
we've done
if we have a look at the current
environment for that shale session we
you can see that we've created three
variables here one is AWS session token'
and this is the token that we retrieved
earlier when we ran the AWS sts get
session token' api
next you'll see that we also have an AWS
secret access key and again this was the
key obtained earlier when we made that
API call and finally we have AWS access
key ID
and that again is the key we obtained
when we made the STS get session token'
API call
so now we've set up our temporary
credentials and when we made the initial
call to get those credentials we used
MFA and that information is now
contained in the credentials that we're
using to make future API calls meaning
that our bucket policy should allow us
to access that protected folder tax
documents we're going to test this by
first putting an item in that folder and
then deleting it let's go ahead and do
that now
now we're going to test our work to make
sure that everything's working as
expected so here we have an API call for
the s3 API put object and we've selected
our bucket and we've chosen a key which
contains the tax documents folder and
we're now going to try and put an object
into that folder in that bucket and
we're uploading a file called my info
text additionally we've specified an ACL
for this particular item called bucket
owner full control which ensures that
the bucket owner has full control over
the uploaded object incidentally you can
also enforce this condition in s3 bucket
policies let's try this now
so indeed that's worked and we have
successfully put an object into that
bucket let's now go and attempt to
delete that object again using our
temporary credentials which include MFA
information
you
again this API call was successful and
we were able to delete the object now as
a final test to prove that this is all
working as we expect we're going to do
the put object one more time but this
time we're going to use Bob's long term
static credentials which don't contain
MFA information in them
so we'll use the same API call we made
before but this time we're going to use
our configured profile named Bob and
that profile has Bob static long-term
credentials configured
and you can see in this case we were
unable to make the API call and received
an access denied message when trying to
put an object into the protected folder
in the bucket two specific protection
elements to these calls the security
credentials being used a temporary and
the credentials were obtained using two
pieces of secure information
Bob's long-term credentials and MFA
information
thanks for watching and happy cloud
computing from all of us here at aw
[Music]
you
[Music]