[Music]
hello
i'm oliver a cloud support engineer here
at the agps office
in bangalore today i'm going to show you
how to secure your agps account
if it is compromised let's get started
security is of utmost importance to aws
and we constantly monitor all aws
accounts
to make sure that your aws account is
secure
however there are scenarios when an
account is compromised if an access key
is exposed in a public forum
for example in github in this video i'll
share the steps you need to take in
order to re-secure your aws account
the first step is to change the aws
account root user password
to change the password for the root user
you must be signed in
as the aws account root user and not an
aws identity
and access management user use your aws
account email address
and password to sign into the aws
management console
as the aws account root user
remember do not use your root user to
utilize or access your account at all
unless absolutely necessary in the upper
right hand corner of the console
choose your account name and number and
then choose
my account on the right side of the page
next to the account settings section
choose edit
if you haven't signed in recently you
might have to sign in again
on the password line choose edit to
change your password
choose a strong password when you have
created a strong password
click save changes note this is the
password you will need to use
the next time you log in the second step
is rotate and delete all root and im
access keys
to rotate access keys for an im user
without interrupting your application
while the first access key is still
active create
a second access key sign into the aws
management console
and navigate to the im console in the
navigation pane
choose users choose the name of the
intended user
and then choose the security credentials
tab
choose create access key and then choose
download.csb file
to save the access key id and secret
access key
to a dot csv file on your computer
store the file in a secure location you
will not have access to the secret
access key again
after this window closes after you
download the dot csv file
choose close the new access key
is active by default at this point you
have two active access keys
update all applications and tools to use
a new access key
determine whether the first access key
is still in use
by reviewing the last use column for the
oldest access key
use only the new access key to confirm
that your applications are working
once you are sure that all applications
and tools are updated
you can delete the first access key
any applications and tools that still
use the original access key
will stop working at this point because
they no longer have access to aws
resources
sign in to the aws management console
and navigate to the im console
in the navigation pane choose users
choose a name of the intended user and
then choose the security credentials tab
locate the access key to delete and
choose a cross button
at the far right of the row then choose
delete
to confirm rotate all the imax's keys
created before the account was
compromised remember
it's recommended to not create or use
root user access keys but if their usage
is absolutely necessary remember to
rotate them as well
or delete root user access keys if you
do not absolutely need to use them
the third step is to delete any
resources on your account you didn't
create
such as amazon elastic compute cloud
instances
amis amazon elastic block store volumes
and snapshots sign into your aws account
and then check that all the resources on
your account
are resources that you have launched
make sure
to check all aws regions even regions
where you have
never launched aws resources
pay special attention to the following
ec2 instances
and emis including instances in the stop
state
ebs volumes and snapshots
if you're not sure how to delete a
resource associated with a particular
aws service
reach out to aws support it's also a
best practice
to actively monitor your account for
more information
see the security best practices article
linked in the associated knowledge
center article
the last step is to respond to any
notification that you receive from aws
support
through the aws support center thanks
for watching
and happy cloud computing from all of us
here at aws
you