- 1. AWS Identity and Access Management AWS Black Belt Tech
Webinar 2014 ()
2. IAM IAM IAM AWS Security Token Service 3. IAM IAM IAM AWS
Security Token Service 4. AWS Identity and Access Management (IAM)
AWS AWS AWS 5. IAM API S3 S3 6. IAM AWS 1AWS5000 IAM 64+=,.@-_
/aws/sa/ 512Basic Latin(!"#$%&'()=~|-^@`{[}]*:+;?_) / 10 AWS
JSON 7. IAM IAM 1AWS100 /aws/ IAM Group 8. IAM ID/ REST,QueryAPI 2
Active/Inactive GitHUB AMI X.509 Certicate SOAPAPI OpenSSL 9. IAM
AWS 128Basic Latin AWS MFA() MFAMFA MFA GemaltoAWS Token (NEW!
2014/5/29) http://onlinenoram.gemalto.com/ MFA PC Google
AuthenticatorTOTP New 10. IAMAWSURL URLAWS Account Alias S3 11. AWS
2014421AWS() AWS IAM 12. IAM IAM IAM AWS Security Token Service 13.
IAM AWS JSON
http://docs.aws.amazon.com/ja_jp/IAM/latest/UserGuide/AccessPolicyLanguage.html
{ "Statement { "Eect": "Allow", "Action": [ " s3:ListBuckets ", "
s3:Get " ], "Resource": [ " arn:aws:s3:::mybucket " ], "Condition":
{ "IpAddress": { "aws:SourceIP": [176.32.92.49/32] } } } ] } 1 14.
{ "Eect": "Allow", "Action": [ " s3:ListBuckets ", " s3:Get " ],
"Resource": [ "arn:aws:s3:::mybucket" ], "Condition": {
"IpAddress": { "aws:SourceIP": [176.32.92.49/32] } } } Eect: Allow
Deny Action: AWS Resource: AWS Condition:
IP176.32.92.49S3ListBucketsGet 15. Action Action ec2:runInstances
ec2:AttachVolume s3:CreateBucket s3:DeleteObject ec2:Describe*
NotAction NotAction: iam:* (IAM"Action": [ " s3:ListBuckets", "
s3:Get*"] 16. Resource Resource EC2 EBS S3 S3 ARN(Amazon Resource
Name) arn:aws: arn:aws:service:region:account:resource
arn:aws:s3:::mybucket
http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
NotResource NotResource : arn:aws:s3:::hoge"Resource": [ "
arn:aws:s3:::mybucket"] 17. ResourceAWS AWS IAM Amazon EC2 Amazon
RDS Amazon Route53 Hostedzone,change Amazon S3 bucket,object Amazon
Glacier vault AWS Storage Gateway gateway,volume,target AWS
CloudTrail
http://docs.aws.amazon.com/IAM/latest/UserGuide/Using_SpecificProducts.html
Amazon SimpleDB domain Amazon Redshift Amazon Kinesis stream Amazon
SNS topic Amazon SQS queue Amazon DynamoDB Table, index Amazon SWF
domain AWS Elastic Beanstalk AWS CloudFomration AWS OpsWorks Amazon
CloudSearch domain Amazon Elastic Transcoder AWS Marketplace 2014/6
18. Amazon EC2Resource VPC VPC Peering connection ID Key pair
Network Interface Subnet Route table Placement group Action
AcceptVpcPeeringConnection, CreateVpcPeeringConnection,
DeleteVpcPeeringConnection
RebootInstances,StartInstances,StopInstances,TerminateInstaces,
RunInstances AttachVolume,DeleteVolume,DetachVolume
Condition"Resource": [ arn:aws:ec2:::instance/i-123abc"]
http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policies-for-amazon-ec2.html
http://docs.aws.amazon.com/AWSEC2/latest/APIReference/ec2-api-permissions.html
Security Group Network ACL Customer gateway Internet gateway DHCP
Options set ID EBSID NEW! 2013/11 2014/6 19. Condition
ResourceAction
http://docs.aws.amazon.com/ja_jp/IAM/latest/UserGuide/AccessPolicyLanguage_ElementDescriptions.html#Condition
"Condition": { "IpAddress": {"aws:SourceIP": 176.32.92.49/32 } }
20. Condition IP Amazon ...IfExists
http://docs.aws.amazon.com/ja_jp/IAM/latest/UserGuide/AccessPolicyLanguage_ElementDescriptions.html#Condition
"Condition": { "StringEquals": {"ec2:ResourceTag/stack": prod"} }
"Condition": { streq": {"ec2:ResourceTag/stack": prod"} } 21.
aws:CurrentTime aws:EpochTime aws:TokenIssueTime aws:principaltype
aws:SecureTransport aws:SourceIp aws:UserAgent aws:userid
aws:username AWS s3:prex sns:Protocol ec2:ResourceTag/tag
"Condition": { "IpAddress": {"aws:SourceIP": 176.32.92.49/32} }
API/ IP 22. EC2 ec2:AccepterVpc ec2:AvailabilityZone
ec2:EbsOptimized ec2:ImageType ec2:InstanceProle ec2:InstanceType
ec2:Owner ec2:Public ec2:ParentSnapshot ec2:PlacementGroup
ec2:PlacementGroupStrategy ec2:Region ec2:RequesterVpc
ec2:ResourceTag/tag-key ec2:RootDeviceType ec2:Tenancy
ec2:VolumeIops ec2:VolumeSize ec2:VolumeType
http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policies-for-amazon-ec2.html
2014/6 "Condition": { "StringEquals": {ec2:ResourceTag/Name":
webserver} } 23. ConditionORAND ConditionANDOR 2013/7/1612:0015:00
IP192.168.176.0/24192.168.143.0/24 "Condition" : {
"DateGreaterThan" : { "aws:CurrentTime" : "2013-07-16T12:00:00Z" },
"DateLessThan": { "aws:CurrentTime" : "2013-07-16T15:00:00Z" },
"IpAddress" : { "aws:SourceIp" :
["192.168.176.0/24","192.168.143.0/24"] } } OR AND AND 24. AWS
Action Resource tag IAM Amazon CloudFront Amazon CloudWatch AWS
Data Pipeline Amazon EC2 Amazon ElastiCache Amazon Elastic
MapReduce Amazon Elastic Transcoder Amazon RDS Amazon Route 53
Amazon S3 / Glacier Amazon Redshift AWS OpsWorks AWS Storage
Gateway Amazon SimpleDB Amazon SES Amazon DynamoDB AWS Action
Resource tag Amazon SNS Amazon SQS Amazon VPC Amazon Direct Connect
Auto Scaling AWS CloudFormation AWS Elastic Beanstalk AWS CloudHSM
Elastic Load Balancing Amazon WorkSpaces AWS Import/Export Amazon
Kinesis Amazon AppStream Amazon CloudSearch Amazon SWF Amazon
CloudTrail IAMAWS
http://docs.aws.amazon.com/ja_jp/IAM/latest/UserGuide/Using_SpecicProducts.html
2014/6 25. IAM IAM
http://awspolicygen.s3.amazonaws.com/policygen.html JSON
http://pro.jsonlint.com/ https://github.com/zaach/jsonlint 26.
IAM(1) {"Version":"2012-10-17", "Statement": [ { "Action": [
"ec2:CreateSnapshot", "ec2:DeleteSnapshot",
"ec2:DescribeSnapshotAttribute", "ec2:DescribeSnapshots" ], "Eect":
"Allow", "Resource": "*" } ] } EBS Version 2012-10-17 27. IAM(2) {
"Statement": [ { "Action": [ "ec2:PurchaseReservedInstancesOering"
], "Eect": "Deny", "Resource": [ "*" ] } ] } RI 28.
{"Version":"2012-10-17", "Statement": [ { "Sid":
"AllowGroupToSeeBucketListInTheConsole", "Action":
["s3:ListAllMyBuckets", "s3:GetBucketLocation"], "Eect": "Allow",
"Resource": ["arn:aws:s3:::*"] }, { "Sid":
"AllowRootAndHomeListingOfCompanyBucket", "Action":
["s3:ListBucket"], "Eect": "Allow", "Resource":
["arn:aws:s3:::my-company"],
"Condition":{"StringEquals":{"s3:prex":["","home/"],"s3:delimiter":["/"]}}
},{ "Sid": "AllowListingOfUserFolder", "Action": ["s3:ListBucket"],
"Eect": "Allow", "Resource": ["arn:aws:s3:::my-company"],
"Condition":{"StringLike":{"s3:prex":["home/Bob/*"]}} },{ "Sid":
"AllowAllS3ActionsInUserFolder", "Action":["s3:*"], "Eect":"Allow",
"Resource": ["arn:aws:s3:::my-company/home/Bob/*"] } ] } IAM(3)
my-company home/Bob Statement Sid 29. IAM(4)
{"Version":"2012-10-17", "Statement": [ { "Sid":
StrictBucketLocation", "Action": ["s3:CreateBucket"], "Condition":
{ "StringEquals": { "s3:LocationConstraint": "ap-northeast-1" } },
"Resource": ["*"], "Eect": "Allow" }, { "Sid": "AllowListBucket",
"Action": ["s3:ListAllMyBuckets", "s3:GetBucketLocation"], "Eect":
"Allow", "Resource": ["arn:aws:s3:::*"] }] } 30. IAM(5) {"Version":
"2012-10-17", "Statement": [ { "Action":
["ec2:StartInstances,"ec2:StopInstances"], "Resource": [
"arn:aws:ec2:*:*:instance/*" ], "Eect": "Allow", "Condition":{
"StringEquals":{ "ec2:ResourceTag/project":"myapp" }}] }
(project,:myapp / 31. IAM(6) { "Version":"2012-10-17",
"Statement":[ { "Eect":"Allow", "Action": "rds:CreateDBInstance",
"Resource":"arn:aws:rds:us-east-1:1234567890:db:test*",
"Condition":{"streq":{"rds:DatabaseEngine":"mysql"}},
"Condition":{"streq":{"rds:DatabaseClass": "db.t1.micro"}} }] }
Mysqlt1.microtestRDS 32. AWSIAM support Deny IAMaws-portal
https://aws.amazon.com/jp/premiumsupport/iam/
http://docs.aws.amazon.com/ja_jp/IAM/latest/UserGuide/ControllingAccessWebsite.html
{Statement: [{ Action: [ support:* ], Eect: Allow, Resource: *}] }
{"Statement":[{ "Eect":"Allow", "Action": [
"aws-portal:ViewBilling", "aws-portal:ViewUsage"] "Resource":"*"}]
} 33. StatementStatement (Deny) Allow Deny(Deny) Deny < Allow
< Deny Statement Allow Deny) Allow Allow Deny Statement Deny 34.
IAM IAMIAMPermission tab
https://policysim.aws.amazon.com/home/index.jsp? Condition 35.
S3SQS IP 36. AWS S3,SQS,SNS { "Statement" : { "Eect":"Allow",
"Principal" : { AWS:arn:aws:iam::Account B:root" },
"Action":"s3:*", "Resource":"arn:aws:s3:::mybucket/*" } } 1.Account
A 2.Account Bmybucket Principal 37. IAM 2,048 IAM 5,120 IAM 10,240
http://docs.aws.amazon.com/IAM/latest/UserGuide/LimitationsOnEntities.html
38. IAM IAM IAM AWS Security Token Service 39. IAM AWSAWS AWS IAM
IAM 10,240 EC2Beanstalk,Data Pipeline 40. : IAM Role for EC2
instances " EC2 EC2 STS(Security Token Service) AWS ID 3API IAM
Role 41. curl
http://169.254.169.254/latest/meta-data/iam/security-credentials/EC2_Admin
{ "Code" : "Success", "LastUpdated" : "2014-06-08T01:51:52Z",
"Type" : "AWS-HMAC", "AccessKeyId" : "ASIAJY2YJ5S2ZYK25BLQ",
"SecretAccessKey" : "Kp1NblZ7mov/4ln7GLu8dqvN5GztXXXXXXXXXXXXXX",
"Token" :
"AQoDYXdzELP//////////wEa0ANmvPx2CpTfOWjuPSMQ+/XXXXXXXXXXXXXXXX",
"Expiration" : "2014-06-08T08:17:52Z" } Role STS " IAM RoleEC2 42.
IAM IAM Role " IAM IAM IAM 43. AWSCredentials credentials = new
BasicAWSCredentials(,ID); AmazonEC2 ec2 = new
AmazonEC2Client(credentials); ec2.describeInstances(); AWS SDK "
AWS CLIIAM Role http://aws.amazon.com/jp/cli/ AmazonEC2 ec2 = new
AmazonEC2Client(); ec2.describeInstances(); IAM Role IAM Role 44. :
IAM IAM S3
http://docs.aws.amazon.com/IAM/latest/UserGuide/cross-acct-access.html
AssumeRole 45. IAM Team Account Acct ID: 111122223333 s3-role
{"Statement":[ { "Effect":"Allow", "Action":s3:*", "Resource":"*" }
] } My AWS Account Acct ID: 123456789012 Jeff S3-role S3API
{"Statement":[{ "Effect":"Allow", "Action":sts:AssumeRole",
"Resource":"arn:aws:iam::111122223333:role/s3-role" } ] }
{"Statement":[{ "Effect":"Allow",
"Principal":{"AWS":"arn:aws:iam::123456789012:root"},
"Action":"sts:AssumeRole" } ] } IAM S3-roles3-roleBs3-roleJeff Jeff
(IAM User) s3-role STS 46. Assumed-Role Session Code Samplepublic
static Credentials getAssumeRoleSession(String AccessKey, String
SecretKey ) { Credentials sessionCredentials;
AmazonSecurityTokenServiceClient client = new
AmazonSecurityTokenServiceClient( Accesskey, GetSecretkey,new
AmazonSecurityTokenServiceCong()); // Store the attributes and
request a new AssumeRole session (temporary security credentials)
AssumeRoleRequest request = new AssumeRoleRequest { DurationSeconds
= 3600, RoleArn = "arn:aws:iam::111122223333:role/s3-role",
RoleSessionName = "S3BucketBrowser" }; AssumeRoleResponse
startSessionResponse = client.AssumeRole(request); if
(startSessionResponse != null) // Check for valid security
credentials or null { AssumeRoleResult startSessionResult =
startSessionResponse.AssumeRoleResult; sessionCredentials =
startSessionResult.Credentials; return sessionCredentials; } else {
throw new Exception("S3 Browser :: Error in retrieving temporary
security creds, received NULL"); } } 47. MFA AWSMFA AWSroleRequire
MFA MFA AssumeRole GetSessionToken { "Version": "2012-10-17",
"Statement": [ { "Eect": "Allow", "Principal": {"AWS":
"Parent-Account-ID"}, "Action": "sts:AssumeRole", "Condition":
{"Null": {"aws:MultiFactorAuthAge": false}} } ] }
http://docs.aws.amazon.com/IAM/latest/UserGuide/MFAProtectedAPI.html
48. IAM IAM IAM AWS Security Token Service 49. AWS Security Token
Service(STS) IAM STS IAM Role for EC2STS Assume Role 50. Temporary
Security Credentials AWS 3 ASIAJTNDEWXXXXXXX
HQUdrMFbMpOHJ3d+Y49SOXXXXXXX
AQoDYXdzEHQakAOAEHxwpf/ozF73gmp9vZDWDPkgFnzwSG/
3ztBw9Z4IUslNNn503+3SeN0nwI3wcdLR8y8Ulv9cnksMrBGjRVrJl2xg+/
CRnI9nJ1tteHp6yso3sP0BVvnxLpNwyIUpHrcTHt+8v2P6Y9/VX2zl8Hc/cy6La0r1/
GuiHb9NEwqt6VIgjPWCZzHXzX8XsUObKhMnAUkY2IdTMrNKXcqVk8VbC6BNTqWsMIIfQPz
9fDjKK1ifAFmHVSWvUxio94n+ebXXpy1NuHnt5JEGV34VPLMsrpZ86b
+eulKNE1suoQ8TM5E1O66rYwizkq6w+cJovUnMxg6ESASBvolsrEioLiP+SE7cX1i8gRrSG9/
KT59GYTlhTzStjjFroCAqZu4KYplGUMCDl1g0twrdXeymsu3GG70Qwu0wSi3WjkW8VPiajahJ
XCEgp6gIgXElwkrBO01H5Y9NNDEyQaq8ocOGBPVRu+DS9LMs9SHASXimnnVeIN
+1FVkXXXXXXXXXXXXXXXXXXXXXXXX 51. Self-sessions (GetSessionToken)
Federated sessions (GetFederationToken) Assumed-role sessions
AssumeRole AssumeRoleWithWebIdentity AssumeRoleWithSAML Session
Access Key Id Secret Access Key Expiration Session Token Temporary
Security Credentials 52. API STSAPI Action GetSessionToken
IAMtemporary security credentials GetFederationToken
Federatedtemporary security credentials AssumeRole IAMIAM Role
temporary security credentials AssumeRoleWithWebIdentity
AmazonFacebookGoogle temporary security credentials
AssumeRoleWithSAML idPSAMLAWS temporary security credentials
http://docs.aws.amazon.com/STS/latest/UsingSTS/Welcome.html 53.
[Min/Max/Default] Self (Account) [15 min / 60 min / 60 min] Self
(IAM User) [15 min / 36 hrs / 12 hrs] Federated [15 min / 36 hrs /
12 hrs] Assumed-role [15 min / 60 min / 60 min] IAMIAM Session
Access Key Id Secret Access Key Expiration Session Token 54. IAMAWS
Accounts Access Key ID Temporary Security Credentials 55. AWS IAM
Temporary Security Credentials IAM Permissions Example Action: *
Eect: Allow Resource: * (implicit) Action: [s3:*, sts:Get*] Eect:
Allow Resource: * Action: [ s3:Get* ] Eect: Allow Resource:
arn:aws:s3:::mybucket/* 56. Identity FederationID AWS LDAPS3
Temporary Security Credentials 57. S3 EC2 S3 IAM S3 58. : API
FederationS3 (Sample - http://aws.amazon.com/code/1288653099190193)
Identity provider Windows Active Directory AD AWS API (S3*)
GetFederationToken API 59. Access Key Secret Key Session Token Get
Federation Token Response AWS API Federation Customer (Identity
Provider) AWS Cloud (Relying Party) AWS Resources User Application
Active Directory Federation Proxy Get Federation Token Request S3
Bucket with Objects Amazon DynamoDB Amazon EC2 APP Federation Proxy
GetFederationTokenRequest() ProxyIAM IAM Proxy AWS API
http://aws.typepad.com/aws_japan/2011/08/aws-identity-and-access-management-now-with-identity-federation.html
60. : Console Federation (Sample -
http://aws.amazon.com/code/4001165270590826) Identity provider
Windows Active Directory AD ADIAM AWS AssumeRole API 61. Console
Federation Customer (IdP) AWS Cloud (Relying Party) AWS Management
Console Browser interface Corporate directory Federation proxy URL
AD 10 URL List RolesRequest Assume Role Response Temp Credentials
Access Key Secret Key Session Token AssumeRole Request combo Box
Federation proxy AssumeRoleRequest() ProxyIAM IAMListRoles assume
role Proxy List RolesResponse 62. SAML 2.0SSO Federation Security
Token Service (STS)Security Assertion Markup Language (SAML AWSID
AWSSSO assumeRoleWithSAML APIAPI New 2013/11/11 63. SAMLConsole
Federation Enterprise (Identity Provider) AWS (Service Provider)
AWS Sign-in Browser interface Corporate identity store Identity
provider IdP AWS AWS SAML
http://aws.typepad.com/aws_japan/2013/11/aws-identity-and-access-management-using-saml.html
64. : Web Identity Federation AssumeRoleWithWebIdentity AWS S3
Google,Facebook,Amazon(Login with Amazon) IAM Role 65. Web Identity
Federation AWS Cloud US-EAST-1 EU-WEST-1 AP-SOUTHEAST-1 AWS
Services Amazon DynamoDB S3 AWS IAM EC2 Instances Token Web
identity Provider Id Token Mobile App
http://aws.typepad.com/aws_japan/2013/05/aws-iam-now-supports-amazon-facebook-and-google-identity-federation.html
66. STS 2014/06 AWS Products AWS Billing and Cost Management Yes
Amazon AppStream Yes Auto Scaling Yes AWS CloudFormation Yes Amazon
CloudFront Yes AWS CloudHSM No Amazon CloudSearch Yes AWS
CloudTrail Yes Amazon CloudWatch Yes AWS Data Pipeline Yes AWS
Direct Connect Yes Amazon DynamoDB Yes AWS Elastic Beanstalk No
Amazon Elastic Compute Cloud Yes AWS Products Elastic Load
Balancing Yes Amazon Elastic MapReduce No Amazon Elastic Transcoder
Yes Amazon ElastiCache Yes Amazon Flexible Payments Service No
Amazon Fulllment Web Service No Amazon Glacier Yes AWS Identity and
Access Management Yes AWS Import/Export Yes Amazon Kinesis Yes AWS
Marketplace Yes AWS Marketplace Management Portal No Amazon
Mechanical Turk No AWS OpsWorks Yes AWS Products Amazon Redshift
Yes Amazon Relational Database Service Yes Amazon Route 53 Yes AWS
Security Token Service Yes Amazon Simple Email Service Yes Amazon
Simple Notication Service Yes Amazon Simple Queue Service Yes
Amazon Simple Storage Service Yes Amazon Simple Workow Service Yes
Amazon SimpleDB Yes AWS Storage Gateway Yes AWS Support Yes Amazon
Virtual Private Cloud Yes Amazon WorkSpaces No
http://docs.aws.amazon.com/STS/latest/UsingSTS/UsingTokens.html 67.
Federation/SSO
http://www.xceedium.com/xsuite/xsuite-for-amazon-web-services
http://www.okta.com/aws/
http://www.symplied.com/solutions/single-sign-on-sso
https://www.pingidentity.com/products/pingfederate/
http://www.cloudberrylab.com/ad-bridge.aspx
http://aws.amazon.com/jp/iam/partners/ 68. IAM IAM IAM AWS Security
Token Service 69. IAM IAM IAMMFA 70. IAM EC2IAM Role IAM Role
Condition AWS 71. IAMAWS STSAWS IAM 72. IAM
http://aws.amazon.com/jp/documentation/iam/ IAM
http://docs.aws.amazon.com/IAM/latest/UserGuide/IAMBestPractices.html
AWS Security Blog http://blogs.aws.amazon.com/security/ 73. Webinar
AWS http://aws.amazon.com/jp/aws-jp-introduction/
