3 ms·

One of the perpetual frustrations with AWS is their relentless focus on adding services rather than fixing more fundamental limitations of usability of their en

One of the perpetual frustrations with AWS is their relentless focus on adding services rather than fixing more fundamental limitations of usability of their entire service. So in some ways, it's a shame this is even necessary, but it really is. Really good of you to release this.

kstrauser 5y ago
I agree. Here's my pet peeve: say you want to require users to log into the AWS console using MFA. You look all over the place for the magic "[ ] Require MFA" checkbox. Nope! Instead, the official docs at https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_aws_my-sec-creds-self-manage-mfa-only.html https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_p... show you how to create an IAM policy that will "deny all" except for some MFA-related stuff unless the use has logged in with MFA. Rather than add the checkbox, they require you to manually set a policy to do it. (Bonus points: the policy as-is doesn't let the user change their password unless they've logged in with MFA, but that's the first thing a brand new user account has to do. Then they can't change their password without MFA, and they can't configure MFA without changing their password. You can update the policy to allow password changes or you can not enforce "user much change password at first login" as a workaround.) I generally like AWS a lot, but there are surely plenty of dark corners in the service. Wonk let us shine some light into a couple of them.
- hrez 5y ago
  One approach is to (auto)nag users to enable MFA and (auto)disable console access if failed to do so. AWS Console with MFA enabled will require MFA. They can self-manage MFA/password at any point.
  - kstrauser 5y ago
    That's an option but it doesn't really scale across a lot of employees. There are many things I'd rather be doing than pestering new employees to enable MFA, when literally every other service we use that offers MFA has a checkbox to require it at the company level.
    - hrez 5y ago
      If you don't do it manually that scales just fine.
AceyMan 5y ago
To draft new IAM policies I've been using the policy sentry tool Salesforce has in their public github and it's definitely been helpful. I'll for sure check out Wonk and see if it's good for my use cases.

kstrauser 5y ago

I agree. Here's my pet peeve: say you want to require users to log into the AWS console using MFA. You look all over the place for the magic "[ ] Require MFA" checkbox. Nope! Instead, the official docs at https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_aws_my-sec-creds-self-manage-mfa-only.html https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_p... show you how to create an IAM policy that will "deny all" except for some MFA-related stuff unless the use has logged in with MFA. Rather than add the checkbox, they require you to manually set a policy to do it. (Bonus points: the policy as-is doesn't let the user change their password unless they've logged in with MFA, but that's the first thing a brand new user account has to do. Then they can't change their password without MFA, and they can't configure MFA without changing their password. You can update the policy to allow password changes or you can not enforce "user much change password at first login" as a workaround.) I generally like AWS a lot, but there are surely plenty of dark corners in the service. Wonk let us shine some light into a couple of them.

hrez 5y ago
One approach is to (auto)nag users to enable MFA and (auto)disable console access if failed to do so. AWS Console with MFA enabled will require MFA. They can self-manage MFA/password at any point.
- kstrauser 5y ago
  That's an option but it doesn't really scale across a lot of employees. There are many things I'd rather be doing than pestering new employees to enable MFA, when literally every other service we use that offers MFA has a checkbox to require it at the company level.
  - hrez 5y ago
    If you don't do it manually that scales just fine.

AceyMan 5y ago

To draft new IAM policies I've been using the policy sentry tool Salesforce has in their public github and it's definitely been helpful. I'll for sure check out Wonk and see if it's good for my use cases.