The 1%: Identity and Governance Patterns from the Most Advanced AWS Customers That You Can Use Today

© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Pop-up Loft
The 1%: Identity and Governance patterns from the most
advanced AWS customers that you can use today
Quint Van Deman,
Global Business Development Manager,
Identity & Directory Services

Motivations
Typically, focus energy getting off start Today, set new yardstick for future
By tableatny (BXP135660) [CC BY 2.0 (http://creativecommons.org/licenses/by/2.0)], via Wikimedia Commons
Attribution-NonCommercial-ShareAlike 2.0 Generic (CC BY-NC-SA 2.0)

Agenda
• Advanced policy authoring / development:
– Policy unit testing: IAM policy simulator.
– Real time IAM monitoring and remediation: AWS Config.
– Policy tuning: Harvesting unused permissions.
• Advanced IAM deployment / management:
– Policy guardrails: Master blacklist policies.
– Pipeline deployments: Bringing CI/CD methods to IAM management.
• Advanced access management:
– Immutable infrastructure: AWS Organizations.
• Honorable mentions (if time permits)
– Policy tokenizing: Generic policies, environment specific deployments.
– Microsegmentation: Thousands of AWS accounts.
– Scoped access: The return of the token vending machine.
• Q & A

Policy unit testing: IAM policy simulator
Does my policy result in the effective permissions I intended?

Does my result match my intent?
• Of course it does, why wouldn’t it?
– Multiple policy layer mistakes: Organizations SCPs, managed & inline IAM policies,
scope down policies, and resource policies (i.e. bucket policies)
– Policy semantic rationalization mistakes: Explicit vs. implicit allows/denies, inclusion
vs. exclusion.
• Be sure with API driven IAM policy simulator:
– Codify your intent as a companion artifact to your policy.
– Test your policy stand alone and in context with existing policies.
– Prevent mistakes before deployment, regression test after deployment.
– IAM:SimulateCustomPolicy, IAM:SimulatePrincipalPolicy

IAM policy simulation: Example
Intent:
“I want to create a policy for my
advanced DevOps group that allows
broad AWS access, except for IAM and
AWS CloudTrail. Because this is the
production web account, they should
also not have access to Amazon
WorkSpaces.”
Drafted Policy:
{
"Version": "2012-10-17",
"Statement": [
{
"NotAction": [
"iam:*",
"cloudtrail:*",
"workspaces:*"
],
"Effect": "Allow",
"Resource": "*"
}
]
}

#!/usr/bin/python
principalstocheck = [ 'arn:aws:iam::123456789012:user/milton',
'arn:aws:iam::123456789012:user/peter' ]
actionstocheck = [ 'iam:AddRoleToInstanceProfile',
<snip>
'cloudtrail:StopLogging',
<snip>
'workspaces:TerminateWorkspaces' ]
with open(opts['--policy']) as policy_file:
policy = policy_file.read()
for principal in principalstocheck:
simulationdict = client.simulate_principal_policy(
PolicySourceArn=principal,ActionNames=actionstocheck,
PolicyInputList=[policy])
evalresults = simulationdict['EvaluationResults']
for evalresult in evalresults:
evaldecision = evalresult['EvalDecision']
if (evaldecision == 'allowed'):
print ‘Found an allowed action, your policy needs work!’

Managed policy for AdministratorAccess is also attached

{
"Version": "2012-10-17",
"Statement": [
{ "Action": "*",
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [ "iam:*", "cloudtrail:*", "workspaces:*" ],
"Effect": "Deny",
"Resource": "*"
} ]
}
Revised Policy

Real time IAM monitoring and remediation: AWS Config
Does my policy (still) result in the effective permissions I intended?

AWS Config: Quick introduction
AWS Config is a service that enables
you to assess, audit, and evaluate the
configurations of your AWS resources.
“Flight data recorder for AWS”
AWS Config Rules are rules that check
those configurations to determine
compliance status.
“Your micro-checker army”

IAM monitoring and remediation: Use cases
• “Regression testing” for IAM policies:
– Situation: Over time, the number of automated systems and human IAM
administrators often increases.
– Challenge: Need a mechanism to ensure that the intent of a given policy is still being
met within the context of other ongoing IAM policy changes.
• Lots of others:
– Review another today (no spoilers!)
– Even more: SEC311 – How to Automate Policy Validation (Re:Invent 2016)
http://bit.ly/2EGwbAU

IAM monitoring and remediation: Solution
AWS Config
Event notifications
of IAM changes
AWS Lambda
Executes policy
simulation checks
Amazon SNS
Notifications of findings
(same code from
simulate)
(human or fully
automated)

IAM monitoring and remediation: example

IAM monitoring and remediation: example
Then, an authorized IAM admin attaches a new policy to user peter…
and AWS Config responds
Initially, all is well

Policy tuning: Harvesting unused permissions
Working towards least privilege by iterative removal of unused permissions

Does my policy enforce the principle of least privilege?
Perfection Operational
Reality
CC0 Creative Commons Free for commercial use No attribution required

Iterating towards perfection
• Start with a close (but likely not perfect) starting point:
– Custom, with a specific intent.
– Standard, from a selection of pre-crafted policies.
– Bounded, with guardrails to make sure we maintain security and compliance.
• Iterate, approach #1: Netflix Aardvark & Repokid
– Deploy policy, run in prod for period of time (90 days by default).
– Analyze permissions using IAM access advisor.
– “Repo” unused permissions by layering explicit deny.
• Iterate, approach #2: Mining CloudTrail
– Deploy policy, run in dev/test for a period of time.
– Mine CloudTrail events (userPrincipal, eventSource, eventName).
– Revise policy in dev/test based on actual called events.
– Deploy policy to prod.

Iterating towards perfection: Netflix OSS
http://bit.ly/2EiWr0R
Netflix Aardvark & Repokid

Iterating towards perfection: Mining CloudTrail (mapper)
#!/usr/bin/python
import json, sys
for line in sys.stdin:
user_data = json.loads(line.strip())
for record in user_data['Records']:
if 'awsRegion' in record:
region = record['awsRegion']
else:
region = 'region_not_found'
if ('userIdentity' in record) and ('arn' in record['userIdentity']):
arn = record['userIdentity']['arn']
#Transform assumed-role arns to make them more logical for this exercise
if ':assumed-role/' in arn:
arnnorolesession = arn.split('/')[0] + '/' + arn.split('/')[1]
arn = arnnorolesession.replace(':assumed-role/',':role/',1)
else:
arn = 'arn_not_found'
if 'eventSource' in record:
eventsrc = record['eventSource']
else:
eventsrc = 'eventsrc_not_found'
if 'eventName' in record:
eventname = record['eventName']
else:
eventname = 'eventname_not_found'
print ('{0}t{1}t{2}t'.format(arn,eventsrc,eventname))
This is a start,
not a solution!

Iterating towards perfection: Mining CloudTrail (reducer)
#!/usr/bin/python
import sys
callsperprincipal = dict()
for line in sys.stdin:
try:
(arn, eventsrc, eventname) = line.strip().split("t")
eventcomposite = eventsrc + ':' + eventname
except ValueError as e:
continue
if arn in callsperprincipal:
if eventcomposite in callsperprincipal[arn]:
# I have already registered this event for this arn, so nothing to do
continue
else:
# I've already seen this arn, but not this event, so append it.
callsperprincipal[arn].append(eventcomposite)
else:
# This is the first time I've seen this arn, so add it to the
# callsperprincipal dict with arn as key and list as value
eventlist = [eventcomposite]
callsperprincipal[arn] = eventlist
for arn, eventlist in callsperprincipal.items():
for eventcomposite in eventlist:
print ('{0},{1}'.format(arn,eventcomposite))
This is a start,
not a solution!

Iterating towards perfection: Mining CloudTrail (steps file)
[
{
"Type" : "STREAMING",
"Name" : "Streaming Program",
"ActionOnFailure" : "CONTINUE",
"Args" : [
"-files",
"s3://<bucket>/Streaming/cloudtraileventsbyprincipalmapper.py,
s3://<bucket>/Streaming/cloudtraileventsbyprincipalreducer.py",
"-mapper",
"cloudtraileventsbyprincipalmapper.py",
"-reducer",
"cloudtraileventsbyprincipalreducer.py",
"-input",
"s3://<bucket>/AWSLogs/123456789012/CloudTrail/us-west-2/2018/02/",
"-output",
"s3://<bucket>/Streaming/TmpOutputX"
]
}
]
This is a start,
not a solution!

Iterating towards perfection: Mining CloudTrail (results)
arn:aws:iam::123456789012:user/michael,dynamodb.amazonaws.com:DescribeGlobalTable
arn:aws:iam::123456789012:user/michael,monitoring.amazonaws.com:DescribeAlarms
arn:aws:iam::123456789012:user/michael,dynamodb.amazonaws.com:DescribeTable
arn:aws:iam::123456789012:user/michael,lambda.amazonaws.com:ListFunctions20150331
arn:aws:iam::123456789012:user/michael,lambda.amazonaws.com:GetFunction20150331v2
arn:aws:iam::123456789012:user/michael,lambda.amazonaws.com:GetPolicy20150331v2
arn:aws:iam::123456789012:user/michael,logs.amazonaws.com:DescribeMetricFilters
arn:aws:iam::123456789012:user/michael,dynamodb.amazonaws.com:ListTables
arn:aws:iam::123456789012:user/michael,autoscaling.amazonaws.com:DescribeScalableTargets
arn:aws:iam::123456789012:user/michael,lambda.amazonaws.com:ListEventSourceMappings20150331
arn:aws:iam::123456789012:user/michael,sns.amazonaws.com:ListTopics
arn:aws:iam::123456789012:user/michael,apigateway.amazonaws.com:GetResources
arn:aws:iam::123456789012:user/michael,kms.amazonaws.com:Decrypt
arn:aws:iam::123456789012:user/michael,lambda.amazonaws.com:ListAliases20150331
arn:aws:iam::123456789012:user/michael,kms.amazonaws.com:ListAliases
arn:aws:iam::123456789012:user/michael,cloudformation.amazonaws.com:DescribeStackResources
arn:aws:iam::123456789012:user/michael,lambda.amazonaws.com:ListTags20170331
arn:aws:iam::123456789012:user/michael,sns.amazonaws.com:ListSubscriptions
arn:aws:iam::123456789012:user/michael,apigateway.amazonaws.com:GetStages
arn:aws:iam::123456789012:user/michael,apigateway.amazonaws.com:GetRestApi
arn:aws:iam::123456789012:user/michael,dynamodb.amazonaws.com:DescribeReservedCapacity
arn:aws:iam::123456789012:user/michael,lambda.amazonaws.com:ListVersionsByFunction20150331
arn:aws:iam::123456789012:user/michael,autoscaling.amazonaws.com:DescribeScalingPolicies
arn:aws:iam::123456789012:user/michael,autoscaling.amazonaws.com:DescribePolicies
arn:aws:iam::123456789012:user/michael,ec2.amazonaws.com:DescribeVpcs
This is a start,
not a solution!

Policy guardrails: Master blacklist policies
How can I prevent an administrative error from becoming a security incident?

Final decision =“Deny”
(explicit Deny)
Yes
Final decision =“Allow”
Yes
No Is there an
Allow?
4
Decision
starts at Deny
1
Evaluate all
applicable
policies
2
Is there an
explicit
Deny?
3
No Final decision =“Deny”
(default Deny)
5
• AWS retrieves all policies
associated with the user and
resource.
• Only policies that match the action
and conditions are evaluated.
• If a policy statement
has a Deny, it trumps
all other policy
statements.
• Access is granted
if there is an
explicit Allow and
no Deny.
• By default, an
implicit (default)
Deny is returned.
Quick AWS policy enforcement primer

Policy guardrails: Use cases
• Defense in depth for central IAM administration:
– Situation: Most IAM policies are written as whitelists (explicit allows, implicit denies).
– Challenge: Implicit denies can be superseded by an explicit allow in a different
attached policy.
• IAM administration delegation:
– Situation: Certain governance scenarios require delegation of IAM administration
duties to downstream entities without compromising security or compliance.
– Challenge: AWS IAM works on an all or nothing model.

Policy guardrails: Solution
Step 1: Create master
blacklist policy
Step 2: Create blacklist
attachment function
Step 3: Create new
AWS Config rule
Changes to Roles,
Users, Groups, Policies
Invoke on
event
Attach policy
to IAM
principal
Event fires within seconds.
Explicit deny always trumps.

Policy guardrails: Solution
• Solution fundamentals:
– Event fires within seconds.
– Explicit deny trumps any allow in any other policy.
• Additional details:
– Blacklist must contain denies to protect the attachment mechanism itself.
– Lambda function execution role should be limited to attaching the blacklist.
– A list of excluded IAM principals can be stored as a Lambda parameter.
– Enforce good process around Lambda code deployment.
• Also consider:
– Time based analysis of iam:ListEntitiesForPolicy.
– External check (canary) to monitor operation of attachment mechanism.

Pipeline Deployments: IAM meets CI/CD
If infrastructure is code, why can’t identity and access be code too?

Pipeline deployments: IAM meets CI/CD
• Observation:
– Over time, policy authoring maturity improves.
– However, policy deployment maturity sometimes plateaus.
• Deployment via CI/CD toolchain:
– IAM policies and principals expressed as code.
– Use AWS Code* (or toolchain of your choice).
– Execute any number of automated or human checks before deployment.
– Process rigor enforced by toolchain.
• Several possible models:
– Central team deploying standardized roles (for humans).
– Distributed app teams submitting to centralized toolchain (for execution roles).
– Distributed app teams deploying via distributed toolchains (adjacent to code).

Clone repo
Commit
changes
Build
triggered
Automated
tests
Human
approvals
On pass,
deploy
Fork repo
Commit
changes
Pull
request
Automated
tests
Human
approvals
On pass,
merge
Deploy
Variant 1: Build-centric
Variant 2: Source-centric

• Choose variant based on:
– Experience/comfort with toolchain components.
– Model you’re trying to implement.
• Tests to consider:
– Static inspection (e.g. cfn_nag)
– Policy simulation – unit test
– Policy simulation – blacklist test
– Human review/approval
• Objectives:
– Reject bad submissions before human inspection.
– Over time, increase what can be deployed without human inspection at all.
• Remember security of the pipeline (holds powerful IAM privileges)

Immutable Infrastructure: AWS Organizations
How can I freeze long lived resources (e.g. VPCs)?

What is AWS Organizations?

Create account hierarchy and apply policies
A6
Development Test Production
A8A1
A5
A4A3
A2
A9
A7
Root
Service Control Policies (SCPs) use the same policy language,
but only specify Actions

SCPs are necessary but not sufficient
Allow: EC2:*Allow: S3:* Allow: SQS:*
Allow: EC2:*Allow: EC2:*
SCP IAM
permissions

Immutable Infrastructure: Use cases
• Delegated administration:
– Situation: Central team responsible for basic account setup and security baseline,
downstream teams responsible for all other account management.
– Challenge: Need to ensure that security baseline can’t be modified by anyone other
than the central team.

Immutable Infrastructure: Solution
A6
Setup Test Production
A8
A1
A5
A4
A3A2
A7
Root
Step 1: Create “Setup” OU and “ImmutableInfra” SCP

Immutable Infrastructure: Example SCP
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "*",
"Resource": "*"
},
{
"Effect": "Deny",
"Action": [
"ec2:AttachInternetGateway",
"ec2:CreateInternetGateway“,
“ec2:DeleteSubnet”,
<snip>
],
"Resource": "*"
}
]
}
Include mutating actions for
all resource types you wish to
be immutable.

A6
A8
A1
A5
A4
A3A2
A9 A7
Root
Step 2: Provision new account, place in Setup OU

Step 3: Build desired long lived infrastructure
Central Team

A6
A8
A1
A5
A4
A3A2
A9 A7
Root
Step 4: Move new account to proper OU (SCP now applies)

Result: Infrastructure usable, but immutable
Central Team
X
Downstream Team
X
Root User
X

Honorable mentions
• Policy tokenizing: Generic policies, environment specific deployments.
• Microsegmentation: Thousands of AWS accounts.
• Scoped access: The return of the token vending machine.

Pop-up Loft
aws.amazon.com/activate
Everything and Anything Startups
Need to Get Started on AWS

The 1%: Identity and Governance Patterns from the Most Advanced AWS Customers That You Can Use Today

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Ähnlich wie The 1%: Identity and Governance Patterns from the Most Advanced AWS Customers That You Can Use Today

Ähnlich wie The 1%: Identity and Governance Patterns from the Most Advanced AWS Customers That You Can Use Today (20)

Mehr von Amazon Web Services

Mehr von Amazon Web Services (20)

The 1%: Identity and Governance Patterns from the Most Advanced AWS Customers That You Can Use Today