More about security of IAM roles for EC2

[jlevy]

From HN discussion, we should have more about security implications.
https://news.ycombinator.com/item?id=12687088

Full explanation and pros/cons?

[lynnlangit]

Do you mean using IAM Roles rather than IAM users for EC2? If so, I can take this one. LMK

[jcrites]

Some additional context concerning that HN thread: https://news.ycombinator.com/item?id=12670316

To summarize: since IAM Roles for EC2 can be accessed by any process running on an EC2 instance, certain use-cases warrant taking extra care, such as restricting which processes may connect to the EC2 Instance Metadata Service, to ensure that untrusted processes may not connect (in a scenario where there are multiple security compartments and isolation is desired).

If the EC2 instance VM predominately runs a single application, though, (+ low level, highly trusted supporting infrastructure like sshd) then this may not be a problem.

Overall, IAM Roles for EC2 are still worth using and recommending as the default course of action, in my opinion. They are substantially better than using long-lived access credentials from IAM Users, which have a number of much riskier pitfalls. The tradeoff is that, if you were to distribute IAM User credentials on disk, then you'd benefit from Linux's file system permissions as a form of isolation from untrusted processes.

One can achieve the best of both worlds, however, by using IAM Roles for EC2, along with an iptables rule limiting connections only to trusted processes, or by copying them to disk, or similar

[laurio]

Maybe related - an example of a possible attack vector: https://www.reddit.com/r/programming/comments/56m2sk/ec2s_most_dangerous_feature/d8ku70p?context=3

[jlevy]

@jcrites @laurio thanks for the info. Further thoughts welcome.

@lynnlangit I'm not sure I have a deep enough opinion on this. Sounds like opinions differ. Perhaps we should summarize pros+cons? If you're up for taking it, please do.

[jlevy]

@max-zanko too.

[bwagner5]

Another note is the use of Federated Users using SSO from a company's internal directory service and then using Assume Role when using the API. Obvious benefit is that if an employee is terminated, access is revoked from all systems including AWS at the same time.

[jlevy]

@bwagner5 good point. I think this is wrt EC2 roles only, but that elaboration should go into #285 . If you have experience on federated users, would love your thoughts there.

@jcrites or @lynnlangit sounds like you both have good experience here. Do either of you want to look at writing a couple bullet points on these?

[lynnlangit]

Maybe I am out of my league here, but I feel like if we emphasize the best practice of using IAM roles in lieu of IAM users (w/keys) for EC2 instances, then we cover the most common use cases. I am open to discussion based on other's experience though...