Centrally managing root entry for patrons utilizing AWS Organizations

AWS Identification and Entry Administration (IAM) is launching a brand new functionality permitting safety groups to centrally handle root entry for member accounts in AWS Organizations. Now you can simply handle root credentials and carry out extremely privileged actions.

Managing root person credentials at scale
For a very long time, Amazon Net Companies (AWS) accounts had been provisioned with extremely privileged root person credentials, which had unrestricted entry to the account. This root entry, whereas highly effective, additionally posed vital safety dangers. Every AWS account’s root person needed to be secured by including layers of safety like multi-factor authentication (MFA). Safety groups had been required to handle and safe these root credentials manually. The method concerned rotating credentials periodically, storing them securely, and ensuring that the credentials complied with safety insurance policies.

As our prospects expanded their AWS environments, this handbook strategy turned cumbersome and susceptible to error. For instance, giant enterprises working lots of or hundreds of member accounts struggled to safe root entry persistently throughout all accounts. The handbook intervention not solely added operational overhead but additionally created a lag in account provisioning, stopping full automation and rising safety dangers. Root entry, if not correctly secured, might result in account takeovers and unauthorized entry to delicate sources.

Moreover, at any time when particular root actions reminiscent of unlocking an Amazon Easy Storage Service (Amazon S3) bucket coverage or an Amazon Easy Queue Service (Amazon SQS) useful resource coverage had been required, safety groups needed to retrieve and use root credentials, which solely elevated the assault floor. Even with rigorous monitoring and robust safety insurance policies, sustaining long-term root credentials opened doorways to potential mismanagement, compliance dangers, and handbook errors.

Safety groups started looking for a extra automated, scalable answer. They wanted a technique to not solely centralize the administration of root credentials but additionally programmatically handle root entry while not having long-term credentials within the first place.

Centrally handle root entry
With the brand new means to centrally handle root entry, we deal with the longstanding problem of managing root credentials throughout a number of accounts. This new functionality introduces two important capabilities: the central administration of root credentials and root classes. Collectively, they provide safety groups a safe, scalable, and compliant technique to handle root entry throughout AWS Organizations member accounts.

Let’s first talk about the central administration of root credentials. With this functionality, now you can centrally handle and safe privileged root credentials throughout all accounts in AWS Organizations. Root credentials administration means that you can:

• Take away long-term root credentials – Safety groups can now programmatically take away root person credentials from member accounts, confirming that no long-term privileged credentials are left weak to misuse.
• Forestall credential restoration – It not solely removes the credentials but additionally prevents their restoration, safeguarding in opposition to any unintended or unauthorized root entry sooner or later.
• Provision secure-by-default accounts – As a result of now you can create member accounts with out root credentials from the beginning, you now not want to use further safety measures like MFA after account provisioning. Accounts are safe by default, which drastically reduces safety dangers related to long-term root entry and helps simplify the complete provisioning course of.
• Assist to remain compliant – Root credentials administration permits safety groups to display compliance by centrally discovering and monitoring the standing of root credentials throughout all member accounts. This automated visibility confirms that no long-term root credentials exist, making it simpler to satisfy safety insurance policies and regulatory necessities.

However how can we make sure that it stays attainable to carry out chosen root actions on the accounts? That is the second functionality we launch as we speak: root classes. It provides a safe various to sustaining long-term root entry. As an alternative of manually accessing root credentials at any time when privileged actions are required, safety groups can now acquire short-term, task-scoped root entry to member accounts. This functionality makes certain that actions reminiscent of unlocking S3 bucket insurance policies or SQS queue insurance policies could be carried out securely with out the necessity for long-term root credentials.

Root classes key advantages embody:

• Process-scoped root entry – AWS allows short-term root entry for particular actions, adhering to one of the best practices of least privilege. This limits the scope of what could be accomplished and minimizes the period of entry, decreasing potential dangers.
• Centralized administration – Now you can carry out privileged root actions from a central account while not having to log in to every member account individually. This streamlines the method and reduces the operational burden on safety groups, permitting them to concentrate on higher-level duties.
• Alignment with AWS greatest practices – Through the use of short-term credentials, organizations align themselves with AWS safety greatest practices, which emphasize the precept of least privilege and the usage of short-term, short-term entry the place attainable.

This new functionality doesn’t grant full root entry. It supplies short-term credentials for performing one in every of these 5 particular actions. The primary three actions are attainable with central administration of root accounts. The final two come when enabling root classes.

• Auditing root person credentials – Learn-only entry to evaluate root person info
• Re-enabling account restoration – Reactivating account restoration with out root credentials
• Deleting root person credentials – Eradicating console passwords, entry keys, signing certificates, and MFA units
• Unlocking an S3 bucket coverage – Modifying or deleting an S3 bucket coverage that denies all principals
• Unlocking an SQS queue coverage – Modifying or deleting an Amazon SQS useful resource coverage that denies all principals

Easy methods to acquire root credentials on a member account
On this demo, I present you put together your administration account, create a member account with out root credentials, and acquire short-term root credentials to make one of many 5 licensed API name on the member account. I assume you’ve got a company already created.

First, I create a member account.

aws organizations create-account    
     --email stormacq+rootaccountdemo@amazon.com 
     --account-name 'Root Accounts Demo account'
{
    "CreateAccountStatus": {
        "Id": "car-695abd4ee1ca4b85a34e5dcdcd1b944f",
        "AccountName": "Root Accounts Demo account",
        "State": "IN_PROGRESS",
        "RequestedTimestamp": "2024-09-04T20:04:09.960000+00:00"
    }
}

Then, I allow the 2 new capabilities on my administration account. Don’t fear, these instructions don’t alter the conduct of the accounts in any method aside from enabling use of the brand new functionality.

➜  aws organizations enable-aws-service-access 
        --service-principal iam.amazonaws.com

➜  aws iam enable-organizations-root-credentials-management
{
    "OrganizationId": "o-rlrup7z3ao",
    "EnabledFeatures": [
        "RootCredentialsManagement"
    ]
}

➜  aws iam enable-organizations-root-sessions
{
    "OrganizationId": "o-rlrup7z3ao",
    "EnabledFeatures": [
        "RootSessions",
        "RootCredentialsManagement"
    ]
}

Alternatively, I can even use the console on the administration account. Beneath Entry administration, I choose Account settings.

Now, I’m able to make requests to acquire short-term root credentials. I’ve to go one of many 5 managed IAM insurance policies to scope down the credentials to a particular motion.

➜  aws sts assume-root 
       --target-principal <my member account id> 
       --task-policy-arn arn=arn:aws:iam::aws:coverage/root-task/S3UnlockBucketPolicy 

{
    "Credentials": {
        "AccessKeyId": "AS....XIG",
        "SecretAccessKey": "ao...QxG",
        "SessionToken": "IQ...SS",
        "Expiration": "2024-09-23T17:44:50+00:00"
    }
}

As soon as I acquire the entry key ID, the key entry key, and the session token, I take advantage of them as ordinary with the AWS Command Line Interface (AWS CLI) or an AWS SDKs.

For instance, I can go these three values as setting variables.

$ export AWS_ACCESS_KEY_ID=ASIA356SJWJITG32xxx
$ export AWS_SECRET_ACCESS_KEY=JFZzOAWWLocoq2of5Exxx
$ export AWS_SESSION_TOKEN=IQoJb3JpZ2luX2VjEMb//////////wEaCXVxxxx

Now that I obtained the short-term credentials, I could make a restricted API name as root on the member account. First, I confirm I now have root credentials. The Arn subject confirms I’m working with the foundation account.

# Name get Caller Identification and observe I am root within the member account
$ aws sts get-caller-identity
{
   "UserId": "012345678901",
   "Account": "012345678901",
   "Arn": "arn:aws:iam::012345678901:root"
}

Then, I take advantage of the delete-bucket-policy from S3 to take away an incorrect coverage that has been utilized to a bucket. The invalid coverage eliminated all bucket entry for everyone. Eradicating such coverage requires root credentials.

aws s3api delete-bucket-policy --bucket my_bucket_with_incorrect_policy

When there isn’t any output, it means the operation is profitable. I can now apply an accurate entry coverage to this bucket.

Credentials are legitimate just for quarter-hour. I wrote a brief shell script to automate the method of getting the credentials as JSON, exporting the right setting variables, and issuing the command I wish to run as root.

Availability
Central administration of root entry is offered at no further price in all AWS Areas besides AWS GovCloud (US) and AWS China Areas, the place there isn’t any root account. Root classes can be found all over the place.

You can begin utilizing it by means of the IAM console, AWS CLI or AWS SDK. For extra info, go to AWS account root person in our documentation and comply with greatest practices for securing your AWS accounts.

— seb