AWS CLI multiple profiles

Details on multiple AWS CLI profiles can be found here: http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html#cli-multiple-profiles

Here is a summary of the highlights:
1. Location and name of configuration file:  Directory ~/.aws. File name is config.

2. Define a profile by tying this at command prompt: aws configure --profile tomlaszeast (tomlaszeast is the name of the profile)

3. Setting the profile to use is done using this command:
aws configure --profile tomlaszeast

IAM integration with on premise LDAP

You can manually create IAM users with passwords for access to AWS resources using the AWS Management Console, AWS CLI or API calls. This is a great way to start, but you may already have an identity store (such as Active Directory) that you wish to leverage for AWS resource access. Two methods are possible: Replication and Federation.

With replication, you copy account credentials from your identity store into AWS IAM. This is useful for smaller organizations who need a quick solution without building ongoing connectivity between the two identity stores. While fast to execute, this method has some drawbacks such as: Limited to the number of accounts supported by IAM (5,000 default), changes between identity stores are not automatically propagated, this includes password changes, and disabling or deleting of accounts.

Federation can be done using AWS STS or a third-party such as Okta.   

Remember IAM is not a substitute for an identity store such as Active Directory. 

AWS IAM services and features that play a role when moving Oracle workloads to AWS

Identity and access management (IAM) is a key component of AWS security.  IAM allows the creation of users, groups and roles. IAM services and features you will most likely consider when host Oracle on AWS are:

1. Security Token Service (STS) : STS generates temporary credentials for an IAM User or for users that you authenticate (federated users). Useful for improving security posture, mobile applications, and identity federation. Here are some basics of STS:

A. Generates a temporary Access Key, Secret Key, and Token
B. Expire automatically (15 minutes ~ 36 hours)
C. You write an “identity broker application” ( sample code here: http://docs.aws.amazon.com/STS/latest/UsingSTS/STSSampleApps.html)
D. Users authenticate to your identity broker
E. Your identity broker provisions temporary credentials via STS
F. SSO via the management console: Temporary credentials can be used to sign user directly into the AWS Management Console

More reading: http://docs.aws.amazon.com/STS/latest/UsingSTS/Welcome.html

  Get the temporary temporary token (access key ID, secret Key, and security token) by issuing the get_federation_token API call.  The thing to keep in mind with your identity broker application is that you will have to have all the policies defined some where (in code as below, relational database, XML file, JSON templates, some file, etc) as you probably don't want to hard code in the application and will have 1000's of different users with different policies. 

http://docs.aws.amazon.com/AWSSDKforPHP/latest/index.html#m=AmazonSTS/get_federation_token
The role needs to have a policy associated. Here is the way it is done it code:

// Generate a new IAM policy (https://awspolicygen.s3.amazonaws.com/policygen.html)

$policy = new CFPolicy($token, array(

    'Statement' => array(

        array(

            'Sid' => 'SID' . time(),

            'Action' => array('s3:GetObject', 's3:GetObjectVersion', 's3:ListBucket', 's3:ListBucketVersions'),

            'Effect' => 'Allow',

            'Resource' => 'arn:aws:s3:::my-bucket/*'

        )

    )

));

Here is a REST web services call to generate temporary credentials: http://docs.aws.amazon.com/STS/latest/UsingSTS/CreatingFedTokens.htm

or you can use the assume-role API or web services all in document above. Here you would not need to send in a policy as the role would have a policy:

http://docs.aws.amazon.com/AWSSDKforPHP/latest/index.html#m=AmazonSTS/assume_role

2. IAM resource level permissions - More information can be found here:  http://aws.amazon.com/about-aws/whats-new/2013/07/08/announcing-resource-permissions-for-amazon-ec2-and-amazon-rds/

3. IAM Roles: Roles can be used to securely allow EC2 instances access other AWS services, enables identity federation with STS, cross account access, and web identity federation. 

A. Allow your applications (e.g., Java) running on EC2 to securely access other services (e.g., S3, SQS, etc)

B. Identity federation (including STS)

C. Web Identity federation : Web Identity Federation allows authenticating via Login with Amazon, Facebook, or Google, getting temporary security credentials, and then using those credentials to make a request to AWS. 

D. Allow cross-account management/access

Jane in Account A may assume a Role in Account B, giving Jane an Access Key/Secret Key/Token that may be used to make API calls to Account B. 

More reading:http://docs.aws.amazon.com/IAM/latest/UserGuide/WorkingWithRoles.html

AWS S3 temporary access to S3 bucket files

Sharing files using S3 can be easily be done in the S3 buckets permission by adding 'everyone' to the permissions on the buckets and files. However, you probably don't want any person in the world accessing your files. Here are a couple of quick and easy methods.

1. Temporary URL : Use a tool like S3Fox and you can get a pre-signed URL with a time limit.  This limitation with this approach is that if you have a large number of files you need to generate and send a URL for each file.

2. IAM User : The policies you need to use can be found here: http://mikeferrier.com/2011/10/27/granting-access-to-a-single-s3-bucket-using-amazon-iam/

You also need to provide the URL for IAM user sign-in URL for your account, the IAM user, and the IAM user password. Remember, you need to add a password to the user after you create it.

It is then easy to delete this user or change the password to make sure that if this URL, account and password gets into the wrong hands your files are not downloaded.

EC2 instances adding SSH users

Each EC2 instance has a ec2-user user which can be used access (via SSH) the EC2 Linux instance.  You can add addition SSH users by following these instructions:  http://www.e-zest.net/blog/how-to-add-ssh-users-in-amazon-linux/

Quickbooks on AWS

Running Quickbooks on AWS/EC2 is easy. It is also easy to migrate your data from on premise and online Quickbooks.

Some information on running Quickbooks on AWS/EC2 here:
https://forums.aws.amazon.com/thread.jspa?messageID=364272

Next step is to create an EC2 instance:

http://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/EC2Win_GetStarted.html

You will be running Quickbooks on an AWS EC2 Windows instance and then be using RDP (Microsoft Remote Desktop) to access your AWS online Quickbooks application:
Details on accessing Windows EC2 instances here: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/LaunchingAndUsingInstancesWindows.html

1. Migrating data from on premise Quickbooks to AWS:

Transfer Files to Windows Server Instances from Windows

You can work with your instance the same way you would work with any Windows server. For example, you can transfer files between an Amazon EC2 Windows instance and your local Windows computer using the local file sharing feature of Windows Remote Desktop. If you enable this option in your Windows Remote Desktop Connection software, you can access your local files from your Amazon EC2 Windows instances. You can access local files on hard disk drives, DVD drives, portable media drives, and mapped network drives. For information about this feature, go to the Microsoft Support website or go toThe most useful feature of Remote Desktop I never knew about on the MSDN Blogs website.

2. Migrating data from Quickbooks online edition:
http://support.quickbooks.intuit.com/support/articles/HOW12246

You will most likely need more Windows and Quickbooks licenses:

1. By default, can have two concurrent RDP users on Windows. Can connect more then two users but need to change licensing….

http://social.technet.microsoft.com/Forums/en-US/winserverTS/thread/8987ad6d-5d19-44a9-8835-16208127fdd5/

2. Quickbooks licensing information can be found here:

http://support.quickbooks.intuit.com/support/articles/INF12724

AWS SSO integration with AWS

This is a question that comes up quite often, "How can I delegate authentication into my on premise MS AD for AWS users?"  This product has just been released.

SSO integration with AWS

http://www.okta.com/aws/

They were also showcased in Andy’s keynote on Tuesday at the SF AWS Summit.

http://www.youtube.com/watch?v=bWL0_Xdntzo#t=50m52s  

The other option is to use AWS STS: http://docs.aws.amazon.com/STS/latest/UsingSTS/Welcome.html

AWS getting started with groups and users

A common question is when first setting up and AWS environment is how to prevent developers, OS administrators, DBAs, architectures and all the different roles you may have in your organization from having the correct privileges.  You use IAM group and users.  You would create a developer group.  Ignore roles to start with as these are for AWS services to access other services  (example: EC2 accessing S3) and cross account access.  Then add policies to the group (use policy generator or select a template). Then add each developer as individual users and adding them to the developer group.

Good resource for all of your questions….You can explicitly manage roles and policy

http://docs.aws.amazon.com/IAM/latest/UserGuide/IAMBestPractices.html

http://docs.aws.amazon.com/IAM/latest/UserGuide/cross-acct-access-walkthrough-creategroup.html

Nice blog entry here:
https://forums.aws.amazon.com/message.jspa?messageID=197920