4 ms·

cjhanks' best IAM practices (opinions). 1. All IAM policies/roles and InstanceProfile's should be managed in CloudFormation, no exception. 2. Policies shoul

by cjhanks 10y ago

cjhanks' best IAM practices (opinions). 1. All IAM policies/roles and InstanceProfile's should be managed in CloudFormation, no exception. 2. Policies should not be inlined into the IAM role policy document, rather they should be attached (excepting item 3 and 4). 3. IAM roles which are used for signing S3/CloudFront/... requests which are subsequently made public should should have all policies inlined AND the explicit resource should be defined. 4. IAM roles granting access to an external (non-AWS service) principal should generally inline all statements unless the relationship to the principal can be considered secure. 5. Policies should have multiple statements, one statement per AWS service. 6. Most non-administrative policies dealing with persistent storage (DynamoDB/S3) should be constrained to a limited number of resources. 7. Glob-Star is not permitted for any `Action` statement (ie: no `s3:*`). 8. Absolutely no AWS_ACCESS_KEY's are permitted on EC2 instances.

alexbanks 10y ago
re 8: in favor of ec2 role credentials via the metadata service?
- colemorrison 10y ago
  Without even having to dive into userdata or metadata, just (a) create the role for the ec2; (b) attach the trust and permission policies; (c) create an "instance profile"; (d) attach the instance profile to your target instances. If via console, that gets done behind the scenes when attaching the role. But ya roles use the security token service behind the scenes which allow for temp creds vs. storing sensitive stuffs on the instances.
- cjhanks 10y ago
  Yes.