Skip to content

Commit 79f4c05

Browse files
jacknagzjacknagz
authored
Tutorial: AWS Vault (#1)
* [aws-vault] CloudFormation templates * [aws-vault] Sample vault config * [repo] codeowners and pr template * [aws-vault] add Makefile, rename iam-roles template
1 parent e3f156f commit 79f4c05

File tree

7 files changed

+215
-0
lines changed

7 files changed

+215
-0
lines changed

‎.github/CODEOWNERS

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# These owners will be the default owners for everything in the repo.
2+
* @austinbyers @drixta @jacknagz

‎.github/pull_request_template.md

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
### Background
2+
3+
<High level overview here>
4+
5+
### Changes
6+
7+
* <Describe changes here>
8+
9+
### Testing
10+
11+
* <Testing steps>

‎Makefile

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
deploy:
2+
aws cloudformation deploy --stack-name $(stack) --template-file $(tutorial)/cloudformation/$(stack).yml --region $(region) --capabilities CAPABILITY_NAMED_IAM

‎aws-vault/cloudformation/identity-account-iam-groups.yml

Lines changed: 148 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
AWSTemplateFormatVersion: 2010-09-09
2+
Description: IAM groups, membership, and policies
3+
4+
Mappings:
5+
Accounts:
6+
Production:
7+
AccountId: '123456789012'
8+
9+
Resources:
10+
##### Force MFA #####
11+
12+
ForceMFAGroup:
13+
Type: AWS::IAM::Group
14+
Properties:
15+
GroupName: ForceMFA
16+
17+
# Important: All users in the Identity account must be listed in this group.
18+
ForceMFAMembership:
19+
Type: AWS::IAM::UserToGroupAddition
20+
Properties:
21+
GroupName: !Ref ForceMFAGroup
22+
Users:
23+
- !ImportValue FranklinUserName
24+
25+
# https://amzn.to/2APP3dl
26+
ForceMFAPolicy:
27+
Type: AWS::IAM::Policy
28+
Properties:
29+
PolicyName: ForceMFA
30+
Groups:
31+
- !Ref ForceMFAGroup
32+
PolicyDocument:
33+
Version: 2012-10-17
34+
Statement:
35+
-
36+
Sid: AllowViewAccountInfo
37+
Effect: Allow
38+
Action:
39+
- iam:GetAccountPasswordPolicy
40+
- iam:GetAccountSummary
41+
- iam:ListVirtualMFADevices
42+
Resource: '*'
43+
-
44+
Sid: AllowManageOwnPasswords
45+
Effect: Allow
46+
Action:
47+
- iam:ChangePassword
48+
- iam:GetUser
49+
Resource: arn:aws:iam::*:user/${aws:username}
50+
-
51+
Sid: AllowManageOwnAccessKeys
52+
Effect: Allow
53+
Action:
54+
- iam:CreateAccessKey
55+
- iam:DeleteAccessKey
56+
- iam:ListAccessKeys
57+
- iam:UpdateAccessKey
58+
Resource: arn:aws:iam::*:user/${aws:username}
59+
-
60+
Sid: AllowManageOwnSigningCertificates
61+
Effect: Allow
62+
Action:
63+
- iam:DeleteSigningCertificate
64+
- iam:ListSigningCertificates
65+
- iam:UpdateSigningCertificate
66+
- iam:UploadSigningCertificate
67+
Resource: arn:aws:iam::*:user/${aws:username}
68+
-
69+
Sid: AllowManageOwnSSHPublicKeys
70+
Effect: Allow
71+
Action:
72+
- iam:DeleteSSHPublicKey
73+
- iam:GetSSHPublicKey
74+
- iam:ListSSHPublicKeys
75+
- iam:UpdateSSHPublicKey
76+
- iam:UploadSSHPublicKey
77+
Resource: arn:aws:iam::*:user/${aws:username}
78+
-
79+
Sid: AllowManageOwnGitCredentials
80+
Effect: Allow
81+
Action:
82+
- iam:CreateServiceSpecificCredential
83+
- iam:DeleteServiceSpecificCredential
84+
- iam:ListServiceSpecificCredentials
85+
- iam:ResetServiceSpecificCredential
86+
- iam:UpdateServiceSpecificCredential
87+
Resource: arn:aws:iam::*:user/${aws:username}
88+
-
89+
Sid: AllowManageOwnVirtualMFADevice
90+
Effect: Allow
91+
Action:
92+
- iam:CreateVirtualMFADevice
93+
- iam:DeleteVirtualMFADevice
94+
Resource: arn:aws:iam::*:mfa/${aws:username}
95+
-
96+
Sid: AllowManageOwnUserMFA
97+
Effect: Allow
98+
Action:
99+
- iam:DeactivateMFADevice
100+
- iam:EnableMFADevice
101+
- iam:ListMFADevices
102+
- iam:ResyncMFADevice
103+
Resource: arn:aws:iam::*:user/${aws:username}
104+
-
105+
Sid: DenyAllExceptListedIfNoMFA
106+
Effect: Deny
107+
NotAction:
108+
- iam:CreateVirtualMFADevice
109+
- iam:EnableMFADevice
110+
- iam:GetUser
111+
- iam:ListMFADevices
112+
- iam:ListVirtualMFADevices
113+
- iam:ResyncMFADevice
114+
- sts:GetSessionToken
115+
Resource: '*'
116+
Condition:
117+
BoolIfExists:
118+
aws:MultiFactorAuthPresent: 'false'
119+
120+
##### Allow Users to AssumeRole in other accounts #####
121+
122+
WebAdminGroup:
123+
Type: AWS::IAM::Group
124+
Properties:
125+
GroupName: WebAdmin
126+
127+
WebAdminGroupPolicy:
128+
Type: AWS::IAM::Policy
129+
Properties:
130+
PolicyName: AllowAssumeWebAdminRole
131+
Groups:
132+
- !Ref WebAdminGroup
133+
PolicyDocument:
134+
Version: 2012-10-17
135+
Statement:
136+
-
137+
Effect: Allow
138+
Action: sts:AssumeRole
139+
Resource: !Sub
140+
- arn:aws:iam::${AccountId}:role/WebAdmin
141+
- { AccountId: !FindInMap [ Accounts, Production, AccountId ] }
142+
143+
WebAdminGroupMembership:
144+
Type: AWS::IAM::UserToGroupAddition
145+
Properties:
146+
GroupName: !Ref WebAdminGroup
147+
Users:
148+
- !ImportValue FranklinUserName

‎aws-vault/cloudformation/identity-account-iam-users.yml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
AWSTemplateFormatVersion: 2010-09-09
2+
Description: IAM user accounts
3+
4+
Resources:
5+
Franklin:
6+
Type: AWS::IAM::User
7+
Properties:
8+
UserName: franklin
9+
10+
Outputs:
11+
FranklinUserName:
12+
Value: !Ref Franklin
13+
Export:
14+
Name: FranklinUserName

‎aws-vault/cloudformation/production-account-iam-roles.yml

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
AWSTemplateFormatVersion: 2010-09-09
2+
Description: IAM roles to perform specific actions
3+
4+
Mappings:
5+
Accounts:
6+
Identity:
7+
AccountId: '234567890123'
8+
9+
Resources:
10+
WebAdminRole:
11+
Type: AWS::IAM::Role
12+
Properties:
13+
AssumeRolePolicyDocument:
14+
Version: 2012-10-17
15+
Statement:
16+
-
17+
Effect: Allow
18+
Principal:
19+
# The account that can assume the role
20+
AWS: !FindInMap [ Accounts, Identity, AccountId ]
21+
Action: sts:AssumeRole
22+
Condition:
23+
Bool:
24+
# Enforce MFA and SSL
25+
aws:MultiFactorAuthPresent: true
26+
aws:SecureTransport: true
27+
NumericLessThan:
28+
aws:MultiFactorAuthAge: 3600
29+
ManagedPolicyArns:
30+
- arn:aws:iam::aws:policy/AWSElasticBeanstalkFullAccess
31+
# The temporary credentials last for one hour
32+
MaxSessionDuration: 3600
33+
RoleName: WebAdmin

‎aws-vault/example_vault_config

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
###### web-admin #####
2+
[profile web-admin]
3+
source_profile = identity
4+
role_arn = arn:aws:iam::123456789012:role/WebAdmin
5+
mfa_serial = arn:aws:iam::234567890123:mfa/franklin

0 commit comments

Comments
 (0)