A Real-World Look at AWS Best Practices: IAM User Accounts

Introduction

Best practices for securing an AWS environment have been well-documented and generally accepted, such as AWS’s guidance. However, organizations may still find it challenging on how to begin applying this guidance to their specific environments.

• Which controls should be applied out-of-the-box vs. customized?
• What pitfalls exist in implementing the various controls or checks?
• How do you prioritize remediation of the “sea of red” violations?

In this blog series, we’ll analyze anonymized data from Netskope customers that include security settings of 650,000 entities from 1,143 AWS accounts across several hundred organizations. We’ll look at the configuration from the perspective of the best practices, see what’s commonly occurring in the real world and:

• Discuss specific risk areas that should be prioritized
• Identify underlying root causes and potential pitfalls
• Focus on practical guidance for applying the Benchmark to your specific environment

This blog post continues looking at real-world data for common IAM security controls for regular users. Based on the Netskope dataset analyzed, we will highlight six opportunities to improve security by making simple IAM changes:

1. MFA is not consistently enforced with regular IAM User accounts, with 6% of users without MFA.

2. Many IAM User accounts are unused and should be disabled. 40% of access keys are more than a year old.

3. 11% of users had access keys set up at the time of user account setup, which can lead to unnecessary or unused access keys that can be compromised.

4. 6.7% of IAM users have two access keys, leading to unnecessary access keys that can be compromised.

5. 7,580 (60.8%) IAM Users have access keys that have not been rotated in 90d. 

6. 6,211 (50%) IAM User accounts have not been used in the last 90d. 

IAM Users past

“I told you these were shadows of the things that have been. That they are what they are, do not blame me!”

— The Ghost, Christmas Carol by Charles Dickens

These five best practices relating to regular IAM Users were analyzed against 12,478 IAM Users in 1,143 accounts:

1. MFA: IAM Users

Background: Multi-factor authentication is also recommended for regular IAM Users who have a Console login enabled.

Data: 773 (6.2%) IAM User accounts do not have MFA enabled. 

Analysis: We again need to look at the effective MFA policy for regular IAM Users, including SCP policies. As SCP policy data was not available in this dataset, we instead will focus on standalone AWS accounts: 178 accounts are not part of an AWS organization and do not have MFA enforced by an SCP. In these 178 accounts, 773 (6.2%) IAM User accounts definitively do not have MFA enabled. 

Controls:

• Detection/Audit
  • Detecting whether MFA is enabled or not can be done by checking the mfa_active field in the IAM credential report or via SCP settings at the AWS Organization/OU/root level:
    aws organizations list-policies|describe-policies
  • Using the AWS Config rule:  mfa-enabled-for-iam-console-access will also detect whether MFA is enabled for IAM Users’ Console access.
• Preventing/Auditing
  • Best practices recommend MFA be enabled for all IAM Users. For multiple accounts, it is easier to apply MFA with a Service Control Policy within an AWS Organization or if using a federated identity system, to set MFA policy there.

2. No initial access key setup

Background: Best practices recommend not provisioning access keys during initial user setup, and instead enforce more strict requests via ticketing to minimize unused keys.

Data: Based on the creation time of the user account and the access key, 1331 or 10.7% of the IAM user accounts were set up with an access key by the customer at the same time (during provisioning of the user account).

Analysis: Setting u