Identity management

There are two types of identities you need to manage when approaching operating secure AWS workloads.

• Human identities: The administrators, developers, operators, and consumers of your applications require an identity to access your AWS environments and applications. These can be members of your organization, or external users with whom you collaborate, and who interact with your AWS resources via a web browser, client application, mobile app, or interactive command-line tools.

• Machine identities: Your workload applications, operational tools, and components require an identity to make requests to AWS services, for example, to read data. These identities include machines running in your AWS environment, such as Amazon EC2 instances or AWS Lambda functions. You can also manage machine identities for external parties who need access. Additionally, you might also have machines outside of AWS that need access to your AWS environment.

Best practices

• SEC02-BP01 Use strong sign-in mechanisms
• SEC02-BP02 Use temporary credentials
• SEC02-BP03 Store and use secrets securely
• SEC02-BP04 Rely on a centralized identity provider
• SEC02-BP05 Audit and rotate credentials periodically
• SEC02-BP06 Leverage user groups and attributes