134. Eliminate the IAM User

In this episode, we discuss why IAM users and long-lived credentials are dangerous and should be avoided. We share war stories of compromised credentials and overprivileged access. We then explore solutions like centralizing IAM users, using tools like AWS Vault for temporary credentials, integrating with AWS SSO, and fully eliminating IAM users when possible.

💰 SPONSORS 💰

AWS Bites is brought to you by fourTheorem. If you are looking for a partner to architect, develop and modernise on AWS, give fourTheorem a call. Check out https://fourtheorem.com.


🔖 Chapters:

00:00 Intro
01:22 Connor introduces himself
02:37 What is the problem with IAM users?
07:02 How do programmatic access credentials work in AWS?
11:47 Mitigation strategies for existing IAM users
16:25 Modern solutions with AWS SSO and AWS IAM Identity Center
20:56 Strategies for removing or reducing IAM users in legacy environments
27:02 Conclusion

In this episode, we mentioned the following resources:

Episode 118 "The landing zone: Managing multiple AWS accounts": https://awsbites.com/118-the-landing-...
Episode 96: "AWS Governance and Landing Zone with Control Tower, Org Formation, and Terraform" https://awsbites.com/96-aws-governanc...
Datadog Security Report (IAM stats): https://www.datadoghq.com/state-of-cl...
Credentials provider chain in the JavaScript SDK: https://docs.aws.amazon.com/sdk-for-j...
Credentials provider chain in the AWS CLI: https://docs.aws.amazon.com/cli/v1/us...
Episode 45 "What’s the magic of OIDC identity providers?": https://awsbites.com/45-what-s-the-ma...
Episode 112 "What is a Service Control Policy (SCP)?": https://awsbites.com/112-what-is-a-se...
Episode 115 "What can you do with Permissions Boundaries?": https://awsbites.com/115-what-can-you...



You can listen to AWS Bites wherever you get your podcasts:
Apple Podcasts: https://podcasts.apple.com/us/podcast...
Spotify: https://open.spotify.com/show/3Lh7Pzq...
Google: https://podcasts.google.com/feed/aHR0...
Breaker: https://www.breaker.audio/aws-bites
RSS: ​​https://anchor.fm/s/6a3312a0/podcast/rss


Do you have any AWS questions you would like us to address?
Leave a comment here or connect with us on X, formerly Twitter:
  / eoins  
  / loige  

#startup #finops #cloud #awspartner #hiring