Who has high-level IAM roles in your organization?
Who has high-level IAM roles (e.g. Owner) in your organization, and what steps have been taken to ensure they aren't misused or compromised?
Posted Feb 18, 2022, 9:04 PM UTC
913
CTO of the Company
3
CTO, Sr Director of Operations, and a Senior DevOps Engineer have root level access. It's not their Daily use role, all activity in those roles trigger audit alerts and activity needs to be tied back to a ticket.
2
Director level and above at my org have the IAM + physical hardware RSA / 2FA generators with two locks (2 people hold separate keys and only 2 keys inserted at the same time can unlock the safe holding the 2FA device), they are root owner for Master Payer Account
Devops get Full Adminstrator privileges under some SCP (Service Control Policy, not Secure | Contain | Protect )
2
Apparently my organization needs to be better lol. We have nothing like these other setups.
2
Neither do i
1
[deleted]
1
My team has the root creds and break glass IAM users. Our SIEM alerts anytime someone logs in with any of those accounts and about 5 minutes later I’ve usually got a message from the CyberSecOps manager asking what’s going on.
Pretty much the same. I am have read only for my day to day. The user that applies terraform had admin. I can assume a higher role if needed and security is alerted
My job is Cloud Engineering so my day to day role has most privileges. But those are via an assumed role with federated login, IP restrictions, and MFA. We give our Devs a lot of privileges in their dev accounts. They can create IAM roles and resources in any approved services as long as they meet our naming conventions. AWS Config will delete or add an explicit deny all for any non-compliant resources. i.e. someone creates a public S3 bucket it gets a deny * added to the bucket policy and cuts a ticket to their team queue letting them know what happened.
In test/prod they only have read. Our pipeline accounts have permissions to create/delete things. This enforces them using IaC in test/prod and enforces “account owner” approval before deploying to prod. Account owner in this case being the person in the org responsible for the account, not the actual owner IAM user.
What stops me yanking the terraform user creds and using them from my machine?
It's a iam role. Security is alerted if keys are generated
Isn't it necessary to generate keys to use with the account that can assume the role? For context - we have AWS keys in Jenkins for terraform.. but anyone *could* just print them out and then use them locally. I'd like to protect against that.