Improve the security of your AWS account

As more organizations migrate their infrastructure to the cloud, security in the cloud has become a top priority. One of the most common security issues in AWS is misconfiguration, which can leave organizations vulnerable to attacks and data breaches.

In this article, we will discuss the most common security misconfigurations we find in AWS accounts. Understanding and addressing these misconfigurations can help ensure that your AWS environment is secure and protected from potential threats.

Identity and Access Management (IAM) - Practice Least Privilege

IAM is the main source of access for your AWS account and ensuring that everything is secure is an important part of maintaining your environment.

Let’s say a new contractor is going to start working with your team and you’ve been tasked with creating a new user for them that allows them to perform specific EC2 and RDS actions within the four AWS accounts you use; Identity (where IAM users exist), Prod, Test, and Sandbox.

Using Lambda to Disable IAM Users

Problem

Picture this. You work as a cloud IT professional at a medium size company and you recently hired some AWS contractors. They do a good job, and you get permission to hire more in the future. So you do, and this goes on for some time. However, you get tired of manually removing old contractor users from your IAM groups. What’s an IT pro to do?

Solution

A good way to solve this problem would be to use a scheduled Lambda function and good tagging practices to identify old users and remove their permissions. If you tag any new contractors as role: contractor, you can use a script to identify and remove them from groups automatically using this boto3 method. We will be using the serverless framework to handle the infrastructure deployment for this lambda function. Let’s get into it.