If you’re still using a password to login to your AWS account it’s time you batten down the hatches. With a little work you can dramatically improve security.
1. install command line tools
First get ahold of the aws comand line tools. They’re python based so you’ll need the package manager “pip” first.
$ curl -O https://bootstrap.pypa.io/get-pip.py
$ pip install awscli
Next configure your access key & secret key. You can edit the file below or use “$ aws configure”
$ cat .aws/credentials
aws_access_key_id = AAAAAAAAAAAAAAAABCD
aws_secret_access_key = ABcdefghijklmnop!mnors323
2. Create a new user
You don’t want to be using your aws root user for everything. So we’ll create a new user called “seancli”.
$ aws create-user --user-name "seancli"
$ aws iam create-login-profile --user-name "seancli" --password "seanpass"
Related: Did Airbnb have to fail?
3. give admin privileges
We want our new user to be able to administer things. So let’s give him administrator privileges to AWS resources. AdministratorAccess is a collection of permissions & a policy managed by AWS.
$ aws iam create-group –group-name “admin”
$ aws iam attach-group-policy –group-name “admin” –policy-arn “arn:aws:iam::aws:policy/AdministratorAccess”
$ aws iam add-user-to-group –group-name “admin” –user-name “seancli”
4. Enable MFA
Now for the fun bit. Enable multi-factor authentication. This is important for really making your aws account secure. Remember anyone who gets into your account can delete *ALL* your infrastructure, and/or spinup servers which cost a lot of money. So just a password alone is not sufficient.
MFA uses your phone (or a key fob if you like) as the second factor.
A. Install Google Authenticator
B. Login to your aws dashboard
C. Click your name menu then select “Security Credentials”
D. Open the Multi-factor section
E. Click “activate MFA” & a QR code with display
F. Open your Google Authenticator app & click (+)
G. Select scan barcode
H. Point your smartphone camera at the QR code from step E.
You’ll be asked to enter *two* consecutive six-digit sequences. Once completed, try logging in again.
Also: Are SQL Databases Dead?
5. Test with command line
After you’ve created your new user, you should test it to make sure you can login properly.