...
<resolver:AttributeDefinition id="awsRoles" xsi:type="ad:Mapped" sourceAttributeID="MemberOf"> <resolver:Dependency ref="ldap"/> <resolver:AttributeEncoder name="https://aws.amazon.com/SAML/Attributes/Role" friendlyName="Role" /> <ad:ValueMap> <ad:ReturnValue>arn:aws:iam::$1:saml-provider/Shibboleth,arn:aws:iam::$1:role/$2</ad:ReturnValue> <ad:SourceValue>cn=aws.([^.]*).([^,]*),.*</ad:SourceValue> </ad:ValueMap> </resolver:AttributeDefinition> <resolver:AttributeDefinition id="awsRoleSessionName" xsi:type="ad:Simple" sourceAttributeID="mail"> <resolver:Dependency ref="ldap"/> <resolver:AttributeEncoder name="https://aws.amazon.com/SAML/Attributes/RoleSessionName" friendlyName="RoleSessionName" /> </resolver:AttributeDefinition> |
A caveat with the use of roles is that roles do not support MFA. However, the institution could enforce MFA at the IDP or SSO layer. One of the obvious advantages of using IAM roles over IAM users is that there are no credentials on the AWS side to manage. When a user is taken out of the group or they leave the institution, they lose access to the AWS environment.
...
(a) denotes intended to be automated process
Securing Workloads of Differing Sensitivities at UNC Chapel Hill -
We are just getting started but we are looking at Landing Zone and Control Tower (https://aws.amazon.com/controltower/) as one way to implement auditing and compliance for workloads in AWS for our institution. Specifically, we are looking for a way to manage accounts, monitor the accounts, and set baseline policies for the accounts that are created for researchers or departments. We are also looking into Transit Gateway (https://aws.amazon.com/transit-gateway/) to manage network connections within AWS and back to campus. I expect many of you are already using Organizations (https://docs.aws.amazon.com/organizations/index.html) along with service control and/or AWS Config.
Logging
Just as the practice of syslogging events to a separate host is standard in on-premise environment, logging in cloud environments is also a good practice. In AWS, a technology called CloudTrail enables the ability to log any change to the infrastructure. Coupled with IAM policies, this functionality can ensure that a compromise of the environment can not be hidden.
...