I've seen numerous posts on Reddit about people getting hacked or their access keys leaked. So I started this blog to address the gap in the issue. While AWS launched AWS SSO in 2017, not a lot of people are aware of it and most of the time people still resort to using IAM Users or worse the root account for day to day operations.

Do note that this just improves security, making it harder for attackers to get access and is not a foolproof method to make your account unhackable. You can still get hacked in numerous ways like exposing your access key(it will still be valid up to 1 hour after you first generated it, if you use the default value) or setting a weak root/sso user password with no MFA and many more like granting a random person IAM role access etc. The attack surface is limitless so please still be careful.

Let's start, I am unsure of the level of this blog. But personally, I would put it at level 200.

If you want a semi-automated setup with terraform script, please refer to this blog post

Prerequisite

• an AWS Account

Steps

Initial setup

Go to https://console.aws.amazon.com/singlesignon/home on your AWS console then make sure that you have chosen the AWS region that is closest to you, for this example, I will be using the ap-southeast-1 region.

Go ahead and click Enable

Depending on whether you have enabled AWS Organization or not. You may or may not get this message. But if you do, click on Create AWS organization

Before continuing to create users, groups and permission sets. You will need to define some setup through the console. Unfortunately at the time of writing this blog AWS did not provide any API to enable these settings, so these steps must be done manually, I will probably be updating this guide when it's available.

On your IAM Identity Center dashboard, click on settings on the left navigation bar

Click on Authentication

Click Configure on Standard authentication and then check the box on Send email OTP

Next click Configure on Multi-factor Authentication

You can choose to be creative on this screen, but I would strongly advise that you copy the settings on the screen for maximum security. But you can be flexible between context-aware and always-on, as with anything on security, there's always a tradeoff between more secure and more comfortable, the more comfortable you are the less secure it is like not enforcing MFA.

Note: to improve security even further, you can even choose to disable Authenticator apps and only enable Security keys if you have hardware devices such as Yubikey. But I will take the most common use-case and allow virtual authenticator

Creating permission sets and groups

Now comes the fun part setting up your users and permissions

Go to https://ap-southeast-1.console.aws.amazon.com/singlesignon/home?region=ap-southeast-1#!/accounts/permissionSets

Click on Create permission set

You can choose on one of the predefined permission set or create your own custom. But for this example I will be using the AdministratorAccess predefined permission set

Click on next

Feel free to fill it in or just leave it as the default value, both work. Then hit next and then hit create after you review that the information is correct.

Next go to https://us-east-1.console.aws.amazon.com/singlesignon/home?region=ap-southeast-1#/groups

Create a group with the name of your permission sets with the accountId/accountAlias

Example AdministratorAccess-123456789012

Go to https://us-east-1.console.aws.amazon.com/iamv2/home?region=ap-southeast-1#/organization/accounts

Check the box for your AWS account and then click on Assign users or groups

Check the box the group that we created earlier, then hit Next

Same goes for the permission sets and hit Next and Submit once you reviewed that the information is correct.

Repeat the steps above for all the permission set you want to create

Creating the users and assigning them permissions

Next go to https://us-east-1.console.aws.amazon.com/singlesignon/home?region=ap-southeast-1#/users

Click on Add users

Fill in the details of user that you want to create, then hit Next

Assign the users to the groups that you have created, then hit Next

Review the info then click on Add user

Account Setup

Check the email that you have provided on the users, you should see an email similar to this

If for any reasons you did not receive the email, you can go to https://us-east-1.console.aws.amazon.com/singlesignon/home?region=ap-southeast-1#/users, click on the user and on the top of the page click on Send email verification link

Continue through the setup, by setting up your password and MFA.

Now, you should now be arriving at this page

Now that you have confirmed that you have access, we can start on setting up your temporary credential on the cli.

aws configure sso

SSO session name (Recommended): <You can choose any>
SSO start URL [None]: <Use the url from earlier>
SSO region [None]: <The region that was used earlier>
SSO registration scopes [sso:account:access]: <Just leave blank and hit enter>

Example

SSO session name (Recommended): personal
SSO start URL [None]: https://d-1234acd5.awsapps.com/start/
SSO region [None]: ap-southeast-1
SSO registration scopes [sso:account:access]:

Confirm and continue, then allow it

CLI default client Region [ap-southeast-1]: <Use which ever region best for you>
CLI default output format [None]: <Use which ever format best for you>
CLI profile name [SuperAdmin-198266650228]: default

Example

CLI default client Region [ap-southeast-1]: ap-southeast-1
CLI default output format [None]: json
CLI profile name [SuperAdmin-198266650228]: default

Note: only use the profile default if you only have 1 credential, if you have multiple like SuperAdmin, PowerUser etc. You can separate their naming and pass the --profile parameter every time you want to use them

Now you should be able to use temporary credentials on your terminal and periodically run aws sso login when your session runs out

aws sso login

Cleanup(important)

Cleanup on the root account

Now that everything is done, there are a few cleanup that we need to do

Go to https://us-east-1.console.aws.amazon.com/iam/home#/security_credential

Delete any root access keys that you might have found here. But, before deleting other access keys be sure that you are not using them for anything else or stuff will break.

Secondly, generate a strong password using your password manager for your root account and don't forget to set up MFA to make sure that the root account is never compromised. I would suggest at least a 128-character password with a letter, number and symbol.

There are 2 approaches that you can use, you can store the password in your password manager if you ever need to use the root account in the future or you can choose not to store it and just request a password reset anytime you need to access the root account. This needs to be taken with a grain of salt as you will need to secure and maintain access to the email that is associated with the root account as well.

Ideally, it should look like this

Lastly, as root, you would want to give access to Billing for yourself

Go to https://us-east-1.console.aws.amazon.com/billing/home#/account

then scroll down until you find IAM user and role access to Billing information edit it and activate IAM access

Cleanup on IAM Users

Delete all existing IAM users on your account, but before deleting please be sure that you have re-created the user in IAM Identity Center, assigned the correct permission and you have communicated it clearly to the affected user the new method to login and assume cli access.

Nice to have

Custom domain

You can set a custom domain for your AWS SSO login portal

Go to the settings page we visited earlier from https://ap-southeast-1.console.aws.amazon.com/singlesignon/home -> Scroll down to Identity Source -> Actions -> Customize AWS access portal URL

Troubleshooting

Running issue into assuming different profiles

If you only used the default profile you will not be running into this issue. But if you set up multiple profiles you might have issues such as running the terraform version before 0.12

I would suggest you install Granted-cli and then you can just do

assume profileName

I've seen numerous posts on Reddit about people getting hacked or their access keys leaked. So I started this blog to address the gap in the issue. While AWS launched AWS SSO in 2017, not a lot of people are aware of it and most of the time people still resort to using IAM Users or worse the root account for day to day operations.

Do note that this just improves security, making it harder for attackers to get access and is not a foolproof method to make your account unhackable. You can still get hacked in numerous ways like exposing your access key(it will still be valid up to 1 hour after you first generated it, if you use the default value) or setting a weak root/sso user password with no MFA and many more like granting a random person IAM role access etc. The attack surface is limitless so please still be careful.

Let's start, I am unsure of the level of this blog. But personally, I would put it at level 200.

If you want to setup without the need to install terraform, please refer to this blog post

Prerequisite

• an AWS Account

• Terraform installed -> If not yet you can use tfenv to install terraform on mac/linux, if you are on windows please follow the official guide

• Git

Steps

Initial setup

Go to https://console.aws.amazon.com/singlesignon/home on your AWS console then make sure that you have chosen the AWS region that is closest to you, for this example, I will be using the ap-southeast-1 region.

Go ahead and click Enable

Depending on whether you have enabled AWS Organization or not. You may or may not get this message. But if you do, click on Create AWS organization

Before continuing to create users, groups and permission sets. You will need to define some setup through the console. Unfortunately at the time of writing this blog AWS did not provide any API to enable these settings, so these steps must be done manually, I will probably be updating this guide when it's available.

On your IAM Identity Center dashboard, click on settings on the left navigation bar

Click on Authentication

Click Configure on Standard authentication and then check the box on Send email OTP

Next click Configure on Multi-factor Authentication

You can choose to be creative on this screen, but I would strongly advise that you copy the settings on the screen for maximum security. But you can be flexible between context-aware and always-on, as with anything on security, there's always a tradeoff between more secure and more comfortable, the more comfortable you are the less secure it is like not enforcing MFA.

Setup using terraform

Firstly you would need to get an AWS Access key,

Go to https://us-east-1.console.aws.amazon.com/iam/home#/security_credential

Check the I understand creating a root access key is not a best practice, but I still want to create one. then click on Create access keys. Don't worry this will only be temporary and we will be cleaning up the access keys at the end of this guide. Do note please never share this access key with anyone

Copy the Access key and enter the command below if you are on Mac/Linux

export AWS_ACCESS_KEY_ID=AKIAXXXXXXXXXXXXXXXX

Then copy the Secret access key and enter the command below if you are on Mac/Linux

export AWS_SECRET_ACCESS_KEY=XXXXXXXXXXXXXXX/XXXXXXXXXXXXXXXXXXXXXXXX

Next you can open your favorite text editor and paste the text below into a file

main.tf

module "this" {
  source = "github.com/vincenttjia/terraform-aws-basic-aws-iam-identity-center-setup.git?ref=v1.0.0"

  users = [
    {
      email       = "example@example.com"
      given_name  = "John"
      family_name = "Doe"
    }
  ]
}

output "identity_center_url" {
  value = module.setup.identity_center_url
}

provider "aws" {
  region = "ap-southeast-1"
}

You can look at the example here https://github.com/vincenttjia/terraform-aws-basic-aws-iam-identity-center-setup/tree/master/example

You might also need to change the aws region, depending on what you choose earlier

Then open your terminal, and run the command

terraform init
terraform apply

Note: If you run into validating provider credentials error. you might need to redo the export command above if you run a new terminal session.

Then type yes on your terminal. You can confirm the changes on the AWS Console

Now that we have created the users, you need to assign them permission. In total we have 3 permission sets and you can choose between the 3. But if you want almost the same access as the root account. Please choose SuperAdmin and you will need at least 1 person acting as the SuperAdmin

You can add people using their email using the following configuration

module "this" {
  source = "github.com/vincenttjia/terraform-aws-basic-aws-iam-identity-center-setup.git?ref=v1.0.0"

  users = [
    {
      email       = "example@example.com"
      given_name  = "John"
      family_name = "Doe"
    }
    # ... more users
  ]

  super_admins   = ["example@example.com"]
  power_users    = ["example@example.com", "example1@example.com"]
  readonly_users = ["example@example.com", "example1@example.com"]
}

# ... other configurations

Then run

terraform apply

Now that everything is set up, you can click on the URL on your terminal and then skip to the account setup section.

Account Setup

Enter your email address and then click Next. You should receive an OTP on your email, which you can enter and finish your account setup.

Continue through the setup, by setting up your password and MFA.

You should now be arriving at this page

Now that you have confirmed that you have access, we can start on setting up your temporary credential on the cli.

aws configure sso

SSO session name (Recommended): <You can choose any>
SSO start URL [None]: <Use the url from earlier>
SSO region [None]: <The region that was used earlier>
SSO registration scopes [sso:account:access]: <Just leave blank and hit enter>

Example

SSO session name (Recommended): personal
SSO start URL [None]: https://d-1234acd5.awsapps.com/start/
SSO region [None]: ap-southeast-1
SSO registration scopes [sso:account:access]:

Confirm and continue, then allow it

CLI default client Region [ap-southeast-1]: <Use which ever region best for you>
CLI default output format [None]: <Use which ever format best for you>
CLI profile name [SuperAdmin-198266650228]: default

Example

CLI default client Region [ap-southeast-1]: ap-southeast-1
CLI default output format [None]: json
CLI profile name [SuperAdmin-198266650228]: default

Now you should be able to use temporary credentials on your terminal and periodically run aws sso login when your session runs out

aws sso login

Cleanup(important)

Cleanup on the root account

Now that everything is done, there are a few cleanup that we need to do

Go to https://us-east-1.console.aws.amazon.com/iam/home#/security_credential

And delete the access keys that we generated earlier or any root access keys you might have generated(before deleting other access keys be sure that you are not using them for anything else or stuff will break).

Secondly, generate a strong password using your password manager for your root account and don't forget to set up MFA to make sure that the root account is never compromised. I would suggest at least a 128-character password with a letter, number and symbol.

There are 2 approaches that you can use, you can store the password in your password manager if you ever need to use the root account in the future or you can choose not to store it and just request a password reset anytime you need to access the root account. This needs to be taken with a grain of salt as you will need to secure and maintain access to the email that is associated with the root account as well.

Ideally, it should look like this

Lastly, as root, you would want to give access to Billing for yourself

Go to https://us-east-1.console.aws.amazon.com/billing/home#/account

then scroll down until you find IAM user and role access to Billing information edit it and activate IAM access

Cleanup on IAM Users

Delete all existing IAM users on your account, but before deleting please be sure that you have re-created the user in IAM Identity Center, assigned the correct permission and you have communicated it clearly to the affected user the new method to login and assume cli access.

Nice to have

Custom domain

You can set a custom domain for your AWS SSO login portal

Go to the settings page we visited earlier from https://ap-southeast-1.console.aws.amazon.com/singlesignon/home -> Scroll down to Identity Source -> Actions -> Customize AWS access portal URL

Troubleshooting

Running issue into assuming different profiles

If you only used the default profile you will not be running into this issue. But if you set up multiple profiles you might have issues such as running the terraform version before 0.12

I would suggest you install Granted-cli and then you can just do

assume profileName