AWS Security Best Practices: Use IAM user instead of root account
When you create a new AWS account you are the root user who has unlimited access to everything. Using such a powerful user as root on a day-to-day basis is not such a good idea because if it gets compromised you may not have a way to override and/or undo the changes done by the hacker.
Using IAM user instead of root account
Instead, suggested best practice is to create an admin-level IAM account and use it for normal operations. At first I was hesitant to adopt this practice. I didn’t see the point and thought attaching AdministratorAccess policy awould make the use as powerful as root. But there’s a whole list of things that even the most powerful IAM user cannot do. Here’s the list: AWS Tasks That Require AWS Account Root User Credentials
So as you can see root user has important privileges such as closing the account and changing billing information. Even if your account gets compromised and some mailicous person gains access using an IAM account, you can still log in as root and take necessary action.
In a nutshell, based on AWS documentation the following practices are recommended:
- Use the root user only to create your first IAM user
- Create an IAM user for yourself as well, give that user administrative permissions, and use that IAM user for all your work.
In addition to Eric Hammond suggests in his blog to delete the root account password as well and use Forgot Password option to create a new one when needed. I keep my passwords in a password manager so if that application is compromised, the hacker can reset my password as well so I don’t follow this practice but it might come in handy if you have to write your password down somewhere.
Templated IAM user creation
It’s a good practice to create an IAM user right after you create your AWS account. It’s even a better practice to automate this process. To achieve this I created a CloudFormation template. The YAML template below does the following:
- Creates an IAM group named administrators
- Creates a user named admin
- Attaches AdministratorAccess policy to the group
- Forces the user to change their password first time they log in (by attaching IAMUserChangePassword policy to the user)
Resources:
AdministratorsGroup:
Type: AWS::IAM::Group
Properties:
GroupName: "administrators"
ManagedPolicyArns:
- arn:aws:iam::aws:policy/AdministratorAccess
Path: /
AdminUser:
Type: AWS::IAM::User
Properties:
Groups:
- !Ref AdministratorsGroup
LoginProfile:
Password: "CHANGE_THIS"
PasswordResetRequired: true
ManagedPolicyArns:
- arn:aws:iam::aws:policy/IAMUserChangePassword
Path: /
UserName: "admin"
