Securing your AWS account and its root credentials
“Your AWS account may be compromised” – not the subject line you want to see in an email from AWS Technical support.
Fortunately, the AWS account mentioned in the email did not have Root keys – regardless of what the email said, and the API key referenced in the email notification had been disabled long, long ago.
That email got me thinking about best practices around securing both your AWS account and its API keys. Below, are my top four recommendations on how to protect the API keys associated with your AWS account.
Delete Your Root Keys
If you have root keys in your AWS account – delete them. You’re playing with fire just by having these keys and just asking for trouble if you’re using them in any way. A much better solution is to create a user in Identity and Access Management (IAM), provide it with just enough access (least privilege) to perform the tasks it needs to and use these credentials to manage your AWS account rather than the Root keys.
If you do have Root keys associated with your account, you should be sure that they are not in use somewhere before you remove them. The easiest way to check if the Root keys are in use is via the AWS Management Console. Get logged in and check for keys under the “Access Keys” drop down in “Your Security Credentials.” If you do still have, root keys see the “Last Used” column for when the keys were last accessed.
Don’t Provide Your API Keys to SaaS Vendors
A fantastic ecosystem of solution providers has developed around the AWS platform, which as a user of the platform is great, it makes my job easier, but is not without risk. The issue is that if you create API keys and provide them to a third-party vendor you are assuming that they vendor will protect those keys. As was the case with my keys that didn’t work out so well.
If you want to use a 3rd party solution provider, which I still recommend, find out if they support IAM Roles rather than just providing them with API keys. By using an IAM Role you don’t have to provide any static credentials, API keys are generated dynamically and provided as required.
Rotate Your API Keys
If there’s a service that you just can’t live without, but they don’t support the use of IAM Roles, make sure you have a process for rotating your API keys on a regular basis. Sure, it’s more work, but if something were to happen, at least you can potentially limit the damage.
Since we’re talking about rotating of API keys, it’s probably a good time to check the other keys you have in your account. Remove any API keys that aren’t being used and rotate the ones that are in use.
Monitor Access to Your AWS Account
Finally, even the best plans have flaws, so you need to make sure that you are monitoring your AWS account for any unauthorized changes. I highly recommend that you enable both CloudTrail and AWS Config in your AWS and use them to monitor for unauthorized changes in your account.
I send one newsletter a week, on Monday mornings at 9 AM. The newsletter consists of articles written by me, or items that I’ve read the prior week and thing that my readers will also enjoy.
My day job means that I work with numerous clients who are using Amazon Web Services in lots of different ways to manage their infrastructure and deliver content to their customers. The goal of the articles on the newsletter is to help you learn to avoid mistakes that I’ve made personally, or that I’ve helped others fix.