Anyone who gets into your AWS account can delete all your machines, take your data or, most commonly, create dozens of powerful machines to mine cryptocurrency and leave you the bill. It happens every day, and almost always for the same reason: a leaked password without two-factor, or an access key pushed by mistake to a public repository.
Protecting yourself takes twenty minutes and costs nothing. There are four measures, and the first is the one that really matters: if you only do one, make it that one.
Before you start: what each thing means
- Root account (root user)
- The user the AWS account was created with, the one that signs in with the email address. It can do everything, including closing the account, and it cannot be limited. That is why it has to be kept under lock and key and not used day to day.
- Two-factor (MFA)
- A second step when signing in, in addition to the password: a code that changes every 30 seconds in an app on your phone, or a physical key. If your password is stolen, without the phone they cannot get in.
- Authenticator app
- A free phone app that generates those codes (Google Authenticator, Microsoft Authenticator, Authy and others). Any of them will do.
- IAM
- The AWS service where users are created and given permissions.
- IAM user
- An identity inside your account, with its own name and password, whose actions you can limit. It is what you should sign in with every day, instead of the root account.
- Access key
- The "username and password" that programs use to talk to AWS. The root account should not have any.
- Alternate contacts
- Billing, operations and security addresses and phone numbers that AWS notifies if something happens. If they are out of date, the warnings reach nobody.
Step by step
Turn on two-factor for the root account
Sign in to AWS with the account email (the root account). Top right, menu under your name, Security credentials. In the Multi-factor authentication (MFA) block, click Assign MFA device. Choose Authenticator app, open the app on your phone, scan the QR code and type two consecutive codes. Done: from now on, signing in with the root account will ask for the code from your phone.
You can assign more than one device. Add a second one (another manager's phone, or a physical key kept in a drawer) in case you lose the first: recovering a root account without two-factor is a slow process with AWS.
Remove the root account's access keys
On the same Security credentials screen, Access keys block. If there is one, deactivate it and, once you have checked that nothing stops working, delete it. A root account key is a master key that never expires; nothing should use it. Programs that need access use users or roles with limited permissions (there are guides for both in this section).
Create an administrator user for day-to-day work
Open IAM, Users, Create user. Name: your name or
admin-nombre. Tick Provide user access to the AWS Management Console and choose a password. For permissions, Attach policies directly and tick AdministratorAccess: it will be able to do almost everything, but not close the account or change the payment details, which stay with the root account. Create the user and note down the sign-in address it shows you (it includes your account number).If there are several of you, one user per person. Never share one: when something breaks you will want to know who did it.
Turn on two-factor for that user too
Sign in with the new user, menu under your name, Security credentials, and assign an MFA device just as in step 1. Make it mandatory for every user you create. From now on, always sign in with this user and keep the root account password in a password manager, to be used only when AWS demands it (changing payment details, closing the account, the odd unusual operation).
Update the contacts and set a spending alert
With the root account, menu under your name, Account: check the main email and fill in the Alternate contacts (billing, operations, security) with addresses someone actually reads. They are the ones AWS uses to warn you of a leaked key or unusual activity. And create a budget with an email alert (there is a guide in this section): if someone gets in and starts creating machines, the forecast spending alert will probably be the first sign.
Review from time to time
Once a quarter, in IAM, Users tab: do all these people still work here? Do they all have MFA? Are there access keys that have not been used for months ("Last used" column)? Delete what is not needed. IAM also has a downloadable credential report that summarises all this in a table.
What can go wrong
I have lost the phone with the root account's two-factor
If you registered a second device, use it and remove the lost one. If not, AWS has a recovery process that verifies the account's email and phone; it is slow, which is why we insist on having two devices.
A program stopped working when I removed the root account key
That program was using the master key. Create an IAM user for it with only the permissions it needs (guide in this section) and give it its own key. It is exactly the problem you wanted to uncover.
It asks me for two-factor every time and it is a nuisance
That is the price, and it is small compared with a stolen account. Authenticator apps take three seconds. If it really bothers you, a physical USB key is even faster.
I got an email from AWS saying my key is in a public repository
It is real and it is urgent: there are programs that scan the internet for keys and use them within minutes. Sign in, deactivate that key immediately, check EC2 in every region for machines that are not yours, and reply to the support case AWS will have opened.
In Simplio
Simplio follows these same rules for you: each user signs in with their password and their mandatory two-factor (with no emailed recovery codes that could be stolen), and sensitive actions ask for it again. The AWS keys you register are stored encrypted and never shown again, or simply do not exist if you connect by role. And the activity log says who did what, when and from where.
The same task, in AWS and in Simplio
| In the AWS console | In Simplio | |
|---|---|---|
| Two-factor for the whole team | Set up MFA user by user in IAM and check that they do it | Mandatory for every Simplio user, with no emailed recovery codes |
| Limit what each person does | Hand-written IAM policies | Permissions per action and per machine with tick boxes |
| Know who did what | CloudTrail | Activity log in plain language |