3.4. IAM Best Practices

✔ IAM Best Practices:

● Enable MFA for all users.

MFA, or Multi-Factor Authentication, adds an extra layer of security by requiring two forms of identification before allowing access to a resource. This means that even if someone manages to get a hold of a user’s password, they still cannot access their account without the second factor, such as a code generated by a smartphone app or a physical security token.

Think of MFA like a two-key system for a safe: having just the password (one key) is not enough; you also need a physical key (the second factor). This way, even if someone figures out the password, they still can’t access your precious valuables (your account or data).

✔ IAM Best Practices:

● Use Roles instead of long-term credentials.

Using roles allows you to assign permissions to users or services temporarily, rather than providing them with long-term credentials, such as access keys. This is beneficial for security because roles can be set up to expire after a certain time or can be limited to specific tasks, reducing the risk of exposing the account if credentials are leaked.

Imagine you have a special guest at your home. Instead of giving them a permanent key to your house (long-term credentials), you provide them a temporary access card that only works for a few hours (a role). This keeps your home safe while still allowing access when needed.

✔ IAM Best Practices:

● Audit IAM Policies regularly.

Regularly auditing IAM policies ensures that permissions are correctly assigned and that there are no unnecessary or overly permissive rules. This practice involves reviewing who has access to what resources and making adjustments as necessary to tighten security and prevent unauthorized access.

Think of auditing IAM policies as checking the locks on your doors every few months. Over time, you may have forgotten which keys work on which locks or who has access. By checking them regularly, you ensure that only the right people have access to your property.

✔ IAM Best Practices:

● Apply least privilege principle.

The least privilege principle means giving users only the permissions they absolutely need to perform their tasks, and nothing more. By applying this principle, you minimize the risk of accidental or malicious misuse of resources since users won't have access to everything.

It’s like giving someone a toolbox with only the tools they need for a specific job, rather than handing them the entire garage. This limits what they can potentially damage or misuse.

✔ IAM Best Practices:

● Avoid using root user for daily tasks.

The root user in AWS has full access to all resources and services. It's critical to avoid using this account for everyday tasks because if this account is compromised, an attacker would have unrestricted access to everything in your AWS environment. Instead, use accounts with limited permissions for routine activities and reserve root account usage for necessary actions like account management.

Consider the root user as the owner of a business who has access to all company secrets and finances. If that owner does all the daily operations, like answering phones or managing supplies, they run the risk of exposing sensitive information or making mistakes. Instead, it’s prudent to delegate those tasks to employees with the appropriate access levels.

--