Architecting Automated Operations That Require MFA on AWS | by Teri Radichel | Cloud Safety | Jul, 2022

July 31, 2022

1

Requiring MFA to hold out delicate operations with AssumeRole or GetSessionToken

Once I run a batch job, I wish to require MFA so I’ll want an IAM person for that for causes I already defined.

Potential answer #1:

As soon as the MFA token is processed, the batch job permissions corresponding to retrieving, encrypting, and decrypting information will likely be assigned to an IAM function. The person that executers the batch job with MFA will assume the batch job function to permit the batch job to hold out the required duties with the AssumeRole motion.

Advantages:

The person executing the job solely wants STS assume function permissions.
Every batch job can use a task that has restricted permissions for the duty at hand.

Draw back:

We are able to’t write insurance policies that implement MFA corresponding to requiring MFA when studying information in S3 buckets as a result of API calls made by roles don’t at present embody an MFA indicator. Entry will likely be denied.

I offered extra particulars on this weblog publish:

I want to see that fastened in order that requests by assumed roles embody the person or service that assumed the function and and the right MFA indicator. #awswishlist. That will remedy the issue of not with the ability to create insurance policies that require MFA and it will make safety incident dealing with a lot simpler because you wouldn’t should attempt to hint again the decision made by the function to the unique function assumption within the logs.

Potential answer #2:

Use GetSessionToken to hold out actions based mostly on the permissions assigned to my person. In that situation we will implement MFA on each motion taken as a result of the MFA indicator is included in each request. We may create a bucket coverage that requires MFA and when the batch job leveraging the person’s credentials accesses the bucket it will succeed as a result of the MFA token is current.

If we use the GetSessionToken possibility we will implement MFA on each motion taken by our batch job, however we’d both should create a separate person for each batch job to restrict the permissions of every batch job to a zero-trust set of permissions, or we’d have to offer our person a substantial amount of permissions to carry out all of the actions in each batch job. I clarify zero belief in my e book if you happen to’re not conversant in that time period.

Architecting an answer with zero-trust insurance policies that requires MFA

We are able to overcome the challenges above by combining a set of controls to resolve this drawback. I wish to keep away from these kinds of options every time attainable as a result of they’re sophisticated, and when the subsequent particular person comes alongside and doesn’t perceive why and the way the system was architected the best way it’s, they take away or change one thing that breaks every little thing. However on this case, as a result of the assume function perform doesn’t go the MFA indicator via, we’ll have to consider options if we don’t need give broad permissions or create new customers for each batch job. That appears a bit hokey.

What else may we do?

We may make sure that the one option to entry our batch job assets is with a batch job function.
We are able to make sure that the one means somebody can use that function is that if they assume the function utilizing MFA.

For the reason that batch job roles can solely be assumed with MFA and people are the one issues allowed to entry our batch jobs assets with out MFA we must be moderately certain that MFA is required to entry our batch job assets. We’ll check out that idea within the upcoming weblog posts. We’ll additionally wish to doc this for whomever will likely be sustaining this answer sooner or later so that they don’t take away or change one thing that breaks our safety controls in a while down the road.

Teri Radichel

If you happen to preferred this story please clap and observe:

Medium: Teri Radichel or Electronic mail Record: Teri Radichel
Twitter: @teriradichel or @2ndSightLab
Requests companies by way of LinkedIn: Teri Radichel or IANS Analysis