My organization wants to limit the GCP services any user can use. For example we only want to allow the usage of Big Query.
Is there a way to contract GCP in a way that even the top account (or tenant, organization or whatever) can't instantiate anything besides Big Query?
Thanks
I would recommend maybe trying the following. Basically you want to create a group and apply the proper Big Query roles to the group which will then be inherited by all members of the group. Google allows you to create a "company" group that you can have set to auto-add all current/new users of your organization to.
Take the following steps.
Create a "Company" group by following this article. Make sure to set it up so that current and new users of organization will be added. (if you don't want this then just create a group and add in the users necessary)
In GCP, add the corresponding Big Query roles you want to have applied to all your organization's members to the single group.
As suggested by Jack, you can create a group that grants access only to BigQuery, place all users in that group and grant them no extra permissions.
But you must have at least one project owner account that can do anything in that project.
If you want to secure your organization even further, you can do the following:
Limit the amount of services that can be activated using quotas
Monitor actions performed by users with Audit Logs
Set up alerts that will notify you when certain services are activated
I work with a team of developers that has a shared database hosted in AWS. This team is "virtual" (comprised of remote workers--there is no officesi).
There is an AWS security group that has rules that allow each of the developers to access the database (by IP address). The senior developers have logins and admin permissions to AWS allowing them to change the security group rules--for example when someone's IP address changes.
The problem is that some of the junior developers have "jumpy" IP addresses which change frequently. Each time the IP address changes, a senior developer needs to stop work, login to AWS, and correct the security group rule for the junior developer. This is not sustainable.
Is there a way we can set up AWS so the junior developers can have logins to AWS, but their permissions only allow them to access a single, particular security group? That way the juniors can login to AWS and self-serve on the IP address update, and management doesn't need to worry that they have access to other, restricted areas in AWS?
To directly answer your question, there are multiple ways to achieve what you want and IAM and SCP are the things to take a look at.
With IAM you can either use IAM Permission boundaries to limit the privileges that a certain user has or rely on the ABAC approach where you assign a certain tag to the resource to which you want to grant access to. In your case you can have a "junior" tag set on the SG in question and a respective IAM policy that grants permissions based on it.
Another option is to use a Service Control Policy (in case you have AWS Organization enabled). With SCPs you can limit certain actions on account level (e.g. Deny action on ec2, unless a certain criteria is met).
All of the above are on identity access level.
Networking-wise you can alter your design a bit by setting up an AWS Client VPN in front of the RDS.
Related to AWS:
I've been trying to search for an answer about the Users and Groups that I have created using IAM (AWS), how can I map those Groups with the Organization Unit(s)?
For example: I have a Group called 'Developers' where Users (say 5 Users) are member of it.
Now, I have an Organization Unit of 'ApplicationsDevelopment&Services' where I need to give access to 'Developers'. Can I associate Groups with OUs, so that members of that Group get necessary access.
I have some policies (SCP) applied on that OU, to manage the access boundaries of Developers.
Please suggest if there is a way to do it or something else needs to be done like ActiveDirectory setup (whole new setup)?
Thank You,
Varun Gupta
I recommend to have a look into AWS SSO (https://aws.amazon.com/single-sign-on/?nc1=h_ls). It comes with no additional cost, is enabled with one click and lets you easily assign cross-account role access to Groups/Users.
Going with an IAM Group which you like to have access to all accounts inside one OU, create roles inside those accounts with a trust relationship to the user/group account. You can use a CloudFormation StackSet to enroll the Stack on OU level. Allow sts:AssumeRole for the particular group, resource section pointing to the role you deployed through the StackSet (leave the account_id blank).
Then everyone inside the group should be able to assume the role and deployment of the cross-account role is centralized.
AWS Org SCPs have account or OU scope, they are not for individual IAM users or roles. From aws blog:
Central security administrators use service control policies (SCPs) with AWS Organizations to establish controls that all IAM principals (users and roles) adhere to.
At the account level, a similar type of maximum permissions gourds on individual users or roles (not groups) can be set using permission boundries. Thus, if you have any roles mapped to your uses through AD, you can look at attaching permissions boundaries to them. But, note that permissions boundaries are an advanced IAM topic, thus its not clear for me how exactly they would apply to your use-case.
The AWS official site reads role as a collection of permissions and group as a collection of users. But still they look the same to me. You attach policies to groups or roles, and then assign groups or roles to a user. What exactly are the differences between role and group?
Short answer for googlers: you can't assign role to user.
group is a bunch of users with the same policies
role is a preset of policies for service(s)
Users can asume roles according to AWS docs:
Assuming a Role
AWS Groups are the standard groups which you can consider as collection of several users and a user can belong to multiple groups.
AWS IAM Roles are all together different species; they operate like individual users except that they work mostly towards the impersonation style and perform communication with AWS API calls without specifying the credentials.
Given that IAM Roles are little different, I am emphasizing only that. There are several types of IAM Roles like EC2 IAM Roles, Lambda etc. If you consider, you can launch an EC2 instance with an EC2 IAM Role; hence forth any AWS API related communication wouldn't require any AWS Access Key or Secret key for authentication rather can call the APIs directly (however the long answer is - it uses STS and continuously recycles the credentials behind the scenes); the privileges or permissions of what it can do is determined by the IAM Policies attached to the IAM Role.
Lambda IAM Role works exactly the same, except that only Lambda function can use the Lambda IAM Role etc.
Users: End User (Think People).
Groups: A collection of users under one set of permissions (permission as policy). As per IAM standards we create groups with permissions and then assign user to that group.
Role: you create roles and assign them to AWS resource (AWS resource example can be a customer, supplier, contractor, employee, an EC2 instance, some external application outside AWS) but remember you can't assign role to user.
It’s not only users who will login, sometimes applications need access to AWS resources. For example, an EC2 instance might need to access one or more S3 buckets. Then, an IAM role needs to be created and attached to the EC2 instance. That role can be re-used by different EC2 instances.
Remember : Groups are for living. Roles are for non-living.
I think of an AWS Role as a kind of 'sudo', where each AWS Role can temporarily provide a very specific set of elevated privileges, but without needing the elevated credentials. I get the impression that like sudo, AWS Roles try to prevent privileged actions being used accidentally.
I'd be interested to hear if others agree with this analogy.
Please note that Groups are specific to local IAM users, which are not federated, and local IAM user logs do not show who has done the actions (i.e.., multiple people or applications could use the same long-term secret/access keys, and there is no record of which entity used them). If you must use local IAM users, you can place them into IAM Groups. Where this can be especially useful is to serve as a boundary -- you could place a deny policy on the group, restricting access to specific services or actions, and that deny policy will be applied to all users in the Group.
Conversely, roles can be federated, whereas local IAM users are not. You might create an on-premises AD group that serves as a member container, for example, and then the members of that AD group (and only they) can use the role that the AD group correlates to, with whatever allow or deny policies and/or permissions boundaries you've applied to the role. (Here is a link explaining the AWS ADFS federation.)
Importantly, roles allow for temporary session credentials (which is a best security practice), as their session tokens expire after a maximum of 12 hours. Equally importantly, roles do show in the logs which of the AD members with access to use the role actually did the action. You'll find this tacked to the end of the role ARN in the logs (e.g., a user ID). CloudTrail would be one of several services that indicate user activity. This is important from a logging standpoint.
Understanding IAM roles vs IAM groups (IAM indentities) is very important foundational concept . Its important to look at difference between IAM role and IAM user as essentially group is just a bunch of users performing similar functions (eg. group of developers, QA's etc.) Roles are not uniquely associated with one person (user), they can be assumed by user,resource or service who needs it to perform task at that point of time (session). Roles do not provide long-term credentials like password or access keys.
Best practice recommendation is to require workloads to use temporary credentials with IAM roles to access AWS
Please refer to link below for more clarity:
https://docs.aws.amazon.com/IAM/latest/UserGuide/id.html
I was confused all the time about the difference between these two functions.
In short,
Role is like a tag with all the preset policies that can attach on IAM users/groups or AWS services. IAM users share the same account with the account root user (Admin) but with assigned permissions by the root user to use AWS resources within that account.
Therefore, IAM users can directly interact with AWS services; whereas IAM roles cannot make direct requests to AWS services, they are meant to be assumed by authorised entities like an IAM user or an instance. https://aws.amazon.com/iam/faqs/
I had a hard time deciphering the spirit of the given answers..
Here's what I've found:
Groups:
Intended to represent human users created within IAM who need identical policies.
Ex. Dev 1 - Dev 8 are all developers, and all need access to create dev servers.
This is similar to traditional desktop users/groups, but for HUMAN users only.
Roles:
Roles rotate automatic credentials, meaning password input isn't needed for accessing policies.
This makes it good for two things:
Giving permissions to non-humans, such as services / applications.
Ex. EC2 of type A needs access to S3 of type B.
Giving permissions to federated / outside users & groups.
Ex. Contractor A # Outside Company A needs access to your Server A.
Authentication of users & groups are handled by some service, like Azure AD.
Authorizations are then mapped to your IAM role(s), NOT users or groups.
Note: I've used Jumpcloud's Article & AWS's Documentation to gather this information. The terms "Group", "Role", and "User" become overloaded in context to SSO+IdP, and IAM.
Here's an image showing how they map roles. !Need 10 Reputation :(
Aside: There is a way of assigning Roles to normal IAM Users & Groups, but it appears to be bad practice.
Hopefully this provides clarity to the answers above.
Only one IAM Role can be assumed at a time! And there are several
situations which fits exactly this kind of permission.
Read the faq about: How many IAM roles can I assume?
The underlaying tool in use is "Permission" in both of the use cases namely: Group and IAM Role.
Group or IAM Role --> Has Policy --> Policy defines permisions --> Permissions are assigned to a Group or IAM Role.
Is it possible to grant logina#foo.com full access to all services in loginb#foo.com for AWS Web Services? I have a couple different folks working on my team and I wanted to make it easy for them to do what they need to do in our sandbox.
Thanks!
If you are using something#foo.com to log into your AWS account, you need to stop doing that right now, and set up an IAM (Identity and Access Management) account instead.
There is a best practices document here - you want to look at the section under "Manage AWS Accounts, IAM Users, Groups, and Roles" - but in a nutshell:
Use 2 factor authentication on the root account
create IAM accounts for daily use. If you grant admin access to an IAM account, it should probably be set up with 2 factor authentication as well
turn on CloudTrail. Yes, it will cost you a few cents a month. But if you ever need it, you'll really, really wish you had it.
Never, ever, ever check access keys and secrets into a public repository. (The cost for violating this one will be around $5k/hour.)
set up a billing alarm. Estimate what you'll be spending a month, and set up alarms at 25%, 50%, 75% and 100%. That way if something does go wrong (or you accidentally spin up an r3.8xlarge) you'll get a notice quickly.
Every account only has a single 'root', but using "Identity and Access Management" you can create and account users and grant console login and adminstrative privileges inside the AWS console.
Look under the services tab for one named "IAM".
Select 'Users' from and press the blue 'create new users' button
Add a user login name
Once the user's created
Select the user and set a password via "manage password"--without this they can't log in
Press the 'Permissions" tab for the users and select Attach policy
Give the user the 'Administrtor Access' policy.
The user should then be able to log into the AWS console with admin privs and use the API if they want