11.8 Security Token Service

Security Token Service (STS)

AWS STS can be used to achieve integration between AWS IAM and an on-premise Active Directory infrastructure or LDAP directory service. Grants users limited and temporary access to AWS resources (using Identity Providers and Federations, i.e. IdP, instead of using IAM User or Role). Users can come from three sources:

• Federation (typical Active Directory) ---- SAML 2.0-based Identity Federation

  • Uses Security Assertion Markup Language (SAML)

  • Grants temporary access based off the users Active Directory credentials. Does not need to be a user in IAM.

  • Single sign on allows users to log in to AWS console without assigning IAM credentials.

• Federation with Mobile Apps ---- Web Identity Federation

  • Use Facebook/Amazon/Google or other OpenID providers to log in.

• Cross Account Access

  • Let's users from one AWS account access resources in another. The cross account delegation is useful for allowing existing IAM users to access AWS resources that they don't already have access to. It is useful for existing IAM users as a means to temporarily gain privileged access.

• (Custom Identity Broker)

Understanding The Key Terms

• Federation

  • Combining or joining a list of users in one domain (such as IAM) with a list of users in another domain (such as Active Directory, Facebook, etc)

• Identity Broker

  • A service that allows you to take an identity from point A and join it (federate it) to point B

• Identity Store

  • Services like Active Directory, Facebook, Google, etc.

• Identities

  • A user of a service like Facebook etc.

Scenario

You are hosting a company website on some EC2 web servers in your VPC. Users of the website must log in to the site which then authenticates against the companies active directory servers which are based on site at the companies HQ.

Your VPC is connected to your company HQ via a secure IPSEC VPN. Once logged in the user can only have access to their own S3 bucket. How do you set this up?

Solution:

Enterprise Reporting Application - employees are using enterprise reporting application and this application needs to communicate with object inside S3. What they do is that they log into the reporting application and they enter their usernames and passwords, this is step 1. In step 2, the application calls an identity broker, so the broker captures the usernames and passwords. In step 3, the identity broker check with the LDAP Directory server as to whether or not the username and password is valid and confirm that it is valid. In step 4 and step 5, identity broker initiate a call to the AWS Security Token Service (STS) and /*that call is calling the new GetFederationToken function using IAM credentials. And the call must include an IAM policy and a duration (between 1 to 36 hours) and that is the length of time that this user is going to be logged into the system. You also need to include a policy that specifies the permissions to be granted to the temporary security credentials. The STS then confirm the policy of the IAM user making the call to the GetFederationToken and then gives permission to create new tokens and then*/ AWS STS returns the temporary security credentials with four values: an access key, secret access key, a token and a duration (i.e. the token's lifetime). Once the identity broker has that four values, in step 6, it returns the temporary security credentials to the enterprise recording application, and then in step 7, the enterprise recording application (data storage application) makes a call to S3 using the temporary security credentials (including the token) in order to get some objects from S3. In step 8, S3 uses IAM to verify the credentials/tokens, if correct, then in step 9, IAM will allow the request operation on the given S3 bucket. (So S3 is just like saying that is this security token correct? can this user to do this? And then IAM will say yes to S3.)

And you should remember that procedure when you are going in to the exam, three steps really involved:

• Develop an Identity Broker to communicate with LDAP and AWS STS.

• Identity Broker always authenticates with LDAP first, then with AWS STS.

• Application then gets temporary access to AWS resources.