Security is often overlooked when working in the cloud. Luckily for us,
there are some best practices that are pretty simple to implement to improve the
security of our AWS accounts. That's what we're going to be doing today. First,
we'll set up a new IAM user with less privilege than our root user. Why? Well,
restricting the use of accounts with privileged access reduces the chance of
malicious users getting access or an authorized user mistakenly affecting a
sensitive resource.
IAM allows us to manage access to AWS services and resources securely.
Next, since multi-factor authentication layers on another verification method to
successfully log in, it's a great feature to enable on our accounts.
We'll enable MFA for both our root account and our new user account.
There's plenty to do, so let's dive in.
Alrighty, I am inside of my AWS console and at the top,
I'm going to search for IAM.
This service manages access to AWS resources.
We're going to go ahead and select that.
Let's first go ahead and create a new IAM user with less privilege than our
root user, which we're signed into right now. So on the left side,
we're going to click on users. Next,
we're going to click add user and let's set a username.
We're going to check off AWS management console access,
and then we're going to go ahead and hit next, permissions.
We're going to actually create a group
and we're going to create a group for admin access.
It's good practice to create a group and add permissions to the group.
And then you can add users to the group instead of adding permissions to
individual users, it makes managing permissions easier. Alright,
so we're going to call this admins and next we're going to go ahead and check
off administrator access in the permissions, like the policy list here,
check that off. And then we're going to go ahead and hit create group. Next,
we're going to go ahead and hit tags, and finally, we're going to hit review.
And finally, we're going to hit create user. Alright,
so we do need this password that was auto-generated for us.
So it's hit show and then let's copy it. Fantastic.
We've created the user and we're also going to need this sign-in here.
So let's go ahead and copy that value as well. Great. Now let's hit close.
Next up, we're going to go ahead and enable MFA for the root user.
MFA adds an extra layer of authentication when we sign in.
That will improve the security of our account. Back on the dashboard,
we should see something here under security alerts. Since this is a new account,
it's telling us that the root user for this account does not have multi-factor
authentication, MFA, enabled. Enable MFA,
and this is a link to improve security for this account.
Let's go ahead and click on that. Alrighty,
let's go ahead and click activate MFA.
We're going to select virtual MFA device,
which allows us to use in authentication. We're gonna hit continue.
I have an app on my phone, but if you need a list of compatible applications,
you also have the link here.
I'm going to go ahead and scan the QR code with the app,
and then just give the two codes that the app has generated for me.
Alrighty, let's hit assign MFA. Fantastic. Let's hit close.
Alrighty,
let's head back to the dashboard and we'll see that that security alert is no
longer there.
Now what we're going to do is activate MFA for the user that we just created.
So let's click on users and let's select that user
and we're going to hit security credentials, and we see here assigned MFA,
not assigned. We're going to click manage there.
And we're also going to hit virtual MFA device here,
and it's the same process as activating it for the root user.
So I'm going to go ahead and hit show QR code.
And I'm going to go ahead and add this to the authenticator app that I have on
my phone. Provide two codes. Alright,
it's given me another code. So now I can go ahead and put that one in.
Then hit assign MFA. Alrighty,
all that is left is to sign in with the user that we created that has less
privilege and make sure that it's working.
So what we're going to do is hit sign in.
And what we're going to do is hit sign back into the console. Alrighty,
so make sure you select IAM user and then the 12 digit account ID.
Then we're going to hit next. The IAM user,
and we're going to provide the password that was auto-generated.
And we're going to go ahead and copy that in here. Then hit sign up. Fantastic.
And it looks like multi-factor is working because we were prompted to go ahead
and provide that,
provide that code from the authenticator app on my phone. Alright, fantastic.
Now you see it says you must change your password to continue. This is because,
since the password was auto-generated it only works for the first time that you
are signing in. So let's provide the old password,
which was the auto-generated one,
and let's provide a new password here.
Minimum password length is 10 characters,
requires at least one uppercase letter, requires at least one lowercase letter,
requires at least one number, and at least one non alphanumeric character.
Now we're going to hit confirm password change. And fantastic, we are signed in.
So you can see, that's our IAM username and our account ID.
Alrighty Cloud Gurus,
we've covered how to improve the security of our AWS account with IAM.
We created a new user with just enough permission to use for our daily work.
Then we enabled MFA for both our root user and our new user. Finally,
we signed into our new user, made sure MFA worked,
updated the new user's password,
and we were able to access our AWS console.
That's it for this episode of ACG Fundamentals,
go on and secure your AWS free tier account. Give us a thumbs up once you do.
Don't forget to subscribe for more cloud content. Keep being awesome,
Cloud Gurus. I'll see you in the next one.