The Secret Life of AWS: The Ring of Keys
Part 2 of The Secret Life of AWS
Timothy stood in front of the heavy oak door marked ARCHIVES – RESTRICTED. He jiggled the handle. Locked.
"Margaret," he called out. "I need the key. I want to put this box of records in the back room."
Margaret didn't look up from her desk. "Which key, Timothy?"
"The big one," Timothy said. "The gold one you keep in the glass case. The one that opens everything. It would be so much faster if I just had that key. Then I wouldn't have to ask you every time I need to open a door."
Margaret slowly put down her quill. She stood up, walked over to the glass case where the heavy, ornate Gold Key rested on a velvet pillow, and pointed to it.
"This," she whispered, "is the Root Key. It opens the front door. It opens the safe. It opens the boiler room. It opens the darker places that we do not speak of. If you lose this key, Timothy, you do not just lose a room. You lose the Library."
She turned back to him. "You are not getting the Root Key. You are getting a badge."
The Root User (The Master Key)
In AWS, when you first create an account, you start with one identity that has complete access to every service and every resource in the account. This is the Root User.
- The Power: It can delete databases, cancel the subscription, and remove all other admins.
- The Danger: If a hacker gets your Root credentials, they own your company.
- The Rule: Margaret’s rule is simple. Lock the Root Key away. Create a strong password, enable Multi-Factor Authentication (MFA), and then never use it for daily tasks.
IAM Users (The Badge)
Margaret walked to a large board on the wall. She handed Timothy a small, polished brass nameplate with a pin on the back.
"If you are to work here, Timothy, you need your own identity. You are an IAM User."
She pinned the badge to his lapel.
"This badge identifies you. It is not shared. If you do something foolish, the logs will show that Timothy did it, not 'Someone with the Gold Key'."
IAM (Identity and Access Management) allows you to create individual users for everyone on your team. Each user has their own credentials (password and access keys). This provides accountability.
Groups (The Keyring)
"Now," Margaret said, looking at his badge. "Try the door."
Timothy walked to the Archive door and held up his badge. Nothing happened. "It’s still locked."
"Of course it is," Margaret sighed. "A badge is just a name. It has no power on its own. We must add you to a Group."
She took a heavy iron keyring labeled Junior Librarians and clipped it to his belt.
"The Group has the keys attached to it. The Junior Librarians are allowed to read books and shelve books. They are not allowed to remove books or change the locks."
- Best Practice: Don't assign permissions to users directly. Assign permissions to Groups (e.g., Admins, Developers, Read-Only), and then put users into those groups. If Timothy gets promoted, you just move his badge to the Senior Architects keyring.
Policies (The Written Rules)
Timothy looked at the keyring on his belt. Dangling from it was a small parchment tag with fine writing on it.
"What is this?" he asked.
"That," Margaret said, "is the Policy. It is the mechanism that makes the keys work."
She read the tag aloud:
"Allow: OpenDoor, ReadBook. Deny: RemoveBook."
In AWS, permissions are defined by JSON Policies. A policy is a document that explicitly lists what actions are allowed or denied.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:ListBucket",
"Resource": "arn:aws:s3:::the-grand-archives"
}
]
}
"If the Policy doesn't say you can do it," Margaret warned, "then the door simply won't open. We call this the principle of Least Privilege. You get exactly the access you need to do your job, and not a single degree more."
The Lesson
Timothy touched the keyring on his belt. It wasn't as shiny as the Gold Root Key. It didn't open everything. But it felt solid. He was part of the system now.
"So," Timothy said. "I am a User. I belong to the Junior Librarian Group. And my Policy allows me to open the Archives."
"Precisely," Margaret said, sitting back down. "Now go put that box away. And Timothy?"
"Yes?"
"Rest well. Because tomorrow, we are going to clear out a section of the reading room. You are going to build your first bookshelf."
Aaron Rose is a software engineer and technology writer at tech-reader.blog and the author of Think Like a Genius.
Comments
Post a Comment