1237099 - Please create an AWS IAM user called CloudHealthUser and attach the following policy and send me the access key and secret key

Status: RESOLVED FIXED

(Infrastructure & Operations :: Marketing Infrastructure, task)

Description

[Richard Weiss [:r2]]

This is for the CloudHealth AWS governance tool trial.

In the Engagement Engineering AWS account, create an IAM user called CloudHealthUser
Create a new IAM policy (below), called CloudHealthAccess
Attach the policy to the IAM user
Send the access key and secret key for the user to [e-mail]

IAM policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "aws-portal:ViewBilling",
        "aws-portal:ViewUsage",
        "autoscaling:Describe*",
        "cloudformation:ListStacks",
        "cloudformation:ListStackResources",
        "cloudformation:DescribeStacks",
        "cloudformation:DescribeStackEvents",
        "cloudformation:DescribeStackResources",
        "cloudformation:GetTemplate",
        "cloudfront:Get*",
        "cloudfront:List*",
        "cloudwatch:Describe*",
        "cloudwatch:Get*",
        "cloudwatch:List*",
        "dynamodb:DescribeTable",
        "dynamodb:ListTables",
        "ec2:Describe*",
        "elasticache:Describe*",
        "elasticache:ListTagsForResource",
        "elasticbeanstalk:Check*",
        "elasticbeanstalk:Describe*",
        "elasticbeanstalk:List*",
        "elasticbeanstalk:RequestEnvironmentInfo",
        "elasticbeanstalk:RetrieveEnvironmentInfo",
        "elasticloadbalancing:Describe*",
        "elasticmapreduce:Describe*",
        "elasticmapreduce:List*",
        "iam:List*",
        "iam:Get*",
        "redshift:Describe*",
        "route53:Get*",
        "route53:List*",
        "rds:Describe*",
        "rds:ListTagsForResource",
        "s3:List*",
        "s3:GetBucketTagging",
        "s3:GetBucketLocation",
        "s3:GetBucketLogging",
        "s3:GetBucketVersioning",
        "s3:GetBucketWebsite",
        "sdb:GetAttributes",
        "sdb:List*",
        "sdb:Select*",
        "ses:Get*",
        "ses:List*",
        "sns:Get*",
        "sns:List*",
        "sqs:GetQueueAttributes",
        "sqs:ListQueues",
        "storagegateway:List*",
        "storagegateway:Describe*"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Deny",
      "Action": [
        "autoscaling:DescribeLaunchConfigurations",
        "ec2:DescribeInstanceAttribute",
        "cloudformation:DescribeStacks",
        "sdb:Select"
      ],
      "Resource": [
        "*"
      ]
    }
  ]
}

Comment 1

[Ben (:bensternthal)]

Richard:

I did not realize this was a 3rd party, can you verify this has gone through a sec check and we are good to go? The permissions do not seem too crazy (I don't see any writes) but I want to verify.

Comment 2

[Richard Weiss [:r2]]

Ben:

We did do a security assessment. While their security practices are not very mature, because of the permissions we give them the exposure is small. The security assessment can be found in these bugs:
https://bugzilla.mozilla.org/show_bug.cgi?id=1234847
https://bugzilla.mozilla.org/show_bug.cgi?id=1231499

Comment 3

[Ben (:bensternthal)]

User and role created, encrypted credentials sent to Richard.

Comment 4

[Ben (:bensternthal)]

Note do the security practices being less than mature we will disable this user once finish our evaluation.

Comment 5

[Richard Weiss [:r2]]

Because of the limited exposure granted by this IAM policy, CloudHealth's security practices are deemed to be adequate. That said, if we decide to purchase the service we intend to make a couple of changes on our end:
1. Explode the "*" permissions in the IAM policies so that any permissions we give them are explicit. This will avoid giving them any unintended permissions should Amazon decide to add new capabilities to any existing services covered by the IAM policies.
2. Switch from using IAM users to roles. This will avoid us having to give API keys to CloudHealth while retaining our ability to shut of their access.

Additionally, if CloudHealth adds any new categories of service, we will go through another security review before enabling them.