Amazon EC2 Cookbook by Unknown

Author:Unknown
Language: eng
Format: epub, pdf
Publisher: Packt Publishing

The machine running the client application should be a domain-joined machine. In the client application, you call proxy service to get the temporary credentials and access the S3 data from user folder.

Configuring AWS multifactor authentication

AWS multifactor authentication (MFA) adds an extra layer of security for your AWS users. MFA verifies your identity through something you know (user ID and password) and something you have with you (hardware device or software token). In addition to the user name and password, the user will need to enter a one-time authentication code while logging into the AWS console. As a best practice always configure multifactor authentication for the root account and other highly privileged IAM users. MFA is also used to control access to a specific resource and to AWS service API calls.

Using conditions in the policy, you can specifically allow a user access to a set of services only if the user was authenticated using the MFA code. For example, you can specify a condition that a user is allowed to create or terminate EC2 instances in the production environment only if they are authenticated using MFA.

There are two types of MFA—virtual and hardware. The virtual MFA device uses an application to generate an authentication code that is compatible with time-based one-time password (TOPT) standard. There are several different virtual MFA apps that you can use however note that AWS requires the virtual MFA app to generate a six-digit code. Virtual MFA is free to use, and you will need to either download the official MFA app or use Google Authenticator from your smartphone to implement MFA.

In case you want to implement hardware-based MFA, then you will need to purchase the hardware MFA device from third-party vendors such as Gemalto.

In this recipe, we configure a virtual MFA device (Google Authenticator) with AWS IAM.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.