AWS Security (IAM): Federated Access, Trusted Advisor and Consolidated Billing

An overview of IAM Federated Access, Trusted Advisor and AWS Billing Controls with an introduction to AWS Linked Accounts.

My last two posts in this AWS Security series have been surrounding Identity & Access Management, with last week’s entry looking at how to create your own custom IAM Policies. In this article, I will offer an overview of Federated Access, Trusted Advisor, AWS Billing Controls. I’ll also include an introduction to AWS Linked Accounts.

As we know we can create users and groups within IAM that can be assigned permissions to access specific resources. What if you don’t want to have to create new IAM accounts for potentially hundreds or more of your personnel? Wouldn’t it be better to use your company’s existing Active Directory accounts instead? Or another example might be, perhaps you are developing a mobile app/game and using AWS to host your infrastructure and you want/need the users to authenticate with their Facebook or Google accounts. What is the best way of managing this process — which could involve potentially millions of end users? Federated AWS access is the solution to these scenarios.

What is Federated Access?

Federated access simply allows external entities to temporarily connect and access AWS resources without requiring an existing IAM user account. Unlike the restriction with IAM users, there are no limits on the number of federated users you can have.
Typically AWS supports two methods of Federation, Enterprise Identity Federation, and Web Identify Federation. Enterprise Identity Federation allows your existing Active Directory users to authenticate to your AWS resources, allowing for a Single sign-on (SSO) approach. Web Identify Federation allows you to make mobile apps created on AWS that integrate with Public Identify Providers (IdPs) for authentication such as Facebook, Google or any OpenID Connect provider.

There are different ways to configure your federated users depending on your requirements. If you search, you will find a host of blog entries showing how to do this — many of the posts from AWS.

Within this article, I’ll offer an overview of how federation within an Active Directory situation should look, and how it works. I’ll show the high-level steps involved in how AD allows this temporary access in conjunction with AWS. For this example, federation within Active Directory has integration with SAML 2.0 (Security Assertion Markup Language) and with the Security Token Service (STS) from AWS.

SAML 2.0 allows for SSO through the exchange of access credentials to be passed between an identity provider (IP) and a service provider (SP) through the means of an Assertion.

The Security Token Service (STS) is an AWS web service that allows you to gain temporary security credentials for federated users via IAM benefiting from existing access roles and policies. More information on STS can be found here on an Amazon Web Services page.

Active Directory Federated Access overview

The diagram below shows the typical steps involved in authenticating a federated user to access AWS services.

1. The user initiates an authentication against the Active Directory Federated Service (ADFS) Server via a web browser to the SSO URL
2. If authentication is successful via Active Directory credentials, SAML (Security Assertion Markup Language) will then issue an assertion back to the users’ client
3. The SAML assertion is then sent to the Security Token Service (STS) within AWS to assume a role within IAM using the AssumeRoleWithSAML API (more on this API can be found on this AWS Page)
4. STS then responds to the user requesting federated access with temporary security credentials with an assumed role and associated permissions
5. The user then has federated access to the necessary AWS services as per the Role permissions

This is a simple overview of how the federation is instigated from the user. Corporate Identity Federation is ALWAYS authenticated internally first by Active Directory before AWS.

There are a number of configuration steps required to get to the diagram above implemented and for a complete guide and lengthy step by step process about setting up Enterprise Identity Federation (including the installation of the ADFS Server etc, please click here. It discusses how to set up your Active Directory Groups that map to your pre-defined IAM Roles (Step 3 above) for users that do not have an IAM account, resulting in a Single Sign-on method to your AWS infrastructure.

If you are looking to configure Web Identity Federated Access please click here. This will provide you with very specific instructions on how to configure this setup.

AWS Trusted Advisor

The AWS Trusted Advisor is like having your own AWS specialist constantly looking over your shoulder ensuring you are keeping an eye on your infrastructure for optimal performance, security and best practices. It provides prompts and suggestions that you should make to your AWS environment for added security, such as ensuring your root account is using Multi-Factor Authentication (MFA). It can also allow you to save costs by way of notification that certain services/instances haven’t been used for some time and could potentially be powered down.

AWS Trusted Advisor is accessed from the AWS Console under Management Tools:
When you open Trusted Advisor you are presented with a Dashboard. From here it can displays checks for up to 47 different elements across 4 different areas:

    Cost ooptimization

  1. Security
  2. Fault Tolerance
  3. Performance Improvement

The below screenshots from AWS show the current list checks as of 13th Jan 2016:
These checks can be performed across a range of AWS Services. However, this level of service is only available to customers with Business-level or Enterprise-level support. If you wish to upgrade your level of support please click here to select your support plan.
The default offers 4 checks that can be performed for free:

  1. Service Limits (in the Performance category)
  2. Security Groups – Specific Ports Unrestricted,
  3. IAM Use
  4. MFA on Root Account (in the Security category)

The screenshot below shows an example of these free checks:
As you can see, the Trusted Advisor has identified that I have a number of Security Groups that allow unrestricted access. This is a security risk and Trusted Advisor has alerted me of this issue so that I may take action.

Although these free checks are useful, the full power and potential of AWS Trusted Advisor can only be appreciated with the full access to all 47 checks. If you have a large estate to manage, monitor and assess for best practices then I suggest you take full advantage of the Trusted Advisor service within the corresponding support plan. It could help you save a significant amount of money by ensuring your security is optimized against best practices. It will check to ensure you have the right level of instances and that they optimize for size. TA will also check your High Availability configurations to ensure they are in place in the event of a failure.

Typically in an ever-expanding environment, it can be difficult to stay on top of all of these areas, so having a service to monitor your activities and spot things that you may miss is essential in keeping your estate optimized.

AWS Billing Controls

When it comes to monitoring and managing your AWS financial information, you need to ensure this privilege is restricted to the people who are authorized. Billing is linked with IAM to allow specific restrictions of access to be put in place.

By default, your AWS account owner has full access to all billing information. No other users initially have access. The first time that your root account tries to access the billing information you need to perform the steps below as it’s not automatically activated and isn’t initially visible.

1. Log into AWS Console as the AWS account owner (root)
2. Select your account name in the top right and select ‘My Account’
3. Select ‘Edit’ next to IAM User Access to Billing Information and select the checkbox to activate

The root account can now access the Billing & Cost Management from within the console by selecting your username/account in the top right corner > Billing and Cost Management. From here you are able to access information such as your Bills, Budgets, Reports, Payment History, and Method etc. Some very sensitive information.
If you require other users to access this restrictive area you have to grant specific permissions.

Allowing access to Billing information

You can allow permissions for users to access your billing information via IAM policies and permissions. You are able to refine access within Billing and Cost Management further by allowing some people to view specific information only while some users are allowed to modify certain aspects of the billing information. A full range of permissions and restrictions can be found here.
As an example I have created a policy below that allows viewing access to the ‘Billing’, ‘Payment Method’s and the ‘Usage section within the Billing and Cost Management Dashboard:
This policy can then be applied to a group or specific user as required. For more information on creating custom IAM policies please see my previous article: Creating an IAM Policy: AWS Security

AWS Linked Accounts (Consolidated Billing)

Discussing AWS Linked Accounts follows on nicely from the previous topic of Billing. Linked Accounts allows you to securely link multiple AWS accounts to effectively consolidate all your AWS Billing via a single master Paying Account.

It’s important to point out that by linking accounts, only the billing information is linked, no other information can be accessed between the accounts. Each account still acts completely independent of the other. One account is not able to view AWS services or data from another account.

If you are responsible for the finances across multiple accounts then you are probably aware of how difficult this can be to manage. By consolidating the billing into one Paying Account you reap many advantages. It provides a simple overview of all your accounts each month. Only the Paying Account is charged, and from here you can see the usage of all other accounts in one place. You can even extract charges from separate accounts and export them to a CSV file for father analysis.
The diagram below gives a graphical view of Consolidated Billing.
If you link your account for consolidated billing, I strongly suggest that you enforce strong security on the Paying Account, and certainly implement MFA (Multi-Factor Authentication). For more information on MFA see my previous article here: AWS Security: IAM

How to link your Accounts

To set up Linked accounts and a Paying Account, follow the 6 steps below.

  1. Log in to the AWS account that you want to become the Paying account and from the Console open the ‘Billing and Cost Management’ Dashboard
  2. Select ‘Consolidated Billing’
  3. Select ‘Sign up for Consolidate Billing’
  4. Select ‘Send a Request’ on the Manage Request and Account page
  5. Add the e-mail address of the AWS account that you want to link to your Paying account and click ‘Send’
  6. An e-mail will now be sent to the Account owner of the linked AWS account. From this e-mail, they must follow the link and either ‘Accept’ or ‘Deny’ the linking of the accounts. Once accepted, the AWS accounts are then linked

What are the key elements we have we learned this week?

  • It’s possible to implement SSO (Single sign-on) to the AWS Console by federating user access with your existing Active Directory users instead of issuing separate IAM user accounts
  • Web Identity Federation can be used to authenticate users for mobile applications built on AWS
  • The Trusted Advisor can be used to help manage, identify and implement best practices across your AWS infrastructure and can recommend changes on a Cost optimization, Security, Fault Tolerance and Performance Improvement basis
  • We looked at how to grant access to Billing Information through the use of IAM policies
  • Finally, we learned that you can optimize your Billing Accounts by using Linked AWS accounts and consolidating your billing information

Next week I will address Simple Storage Service (S3). I’ll explain how to set up Bucket Policies to restrict access to specific buckets in addition to exposing your Buckets for public access. Then, I’ll delve into how CloudFront accesses S3 for Content Delivery Network (CDN) purposes.

Thank you for taking the time to read my article. If you have any feedback please leave a comment below.


Written by

Stuart Scott

Stuart is the AWS content lead at Cloud Academy where he has created over 40 courses reaching tens of thousands of students. His content focuses heavily on cloud security and compliance, specifically on how to implement and configure AWS services to protect, monitor and secure customer data and their AWS environment.

Related Posts

Patrick Navarro
Patrick Navarro
— January 22, 2020

Top 5 AWS Salary Report Findings

At the speed the cloud tech space is developing, it can be hard to keep track of everything that’s happening within the AWS ecosystem. Advances in technology prompt smarter functionality and innovative new products, which in turn give rise to new job roles that have a ripple effect on t...

Read more
  • AWS
  • salary
Alisha Reyes
Alisha Reyes
— January 6, 2020

New on Cloud Academy: Red Hat, Agile, OWASP Labs, Amazon SageMaker Lab, Linux Command Line Lab, SQL, Git Labs, Scrum Master, Azure Architects Lab, and Much More

Happy New Year! We hope you're ready to kick your training in overdrive in 2020 because we have a ton of new content for you. Not only do we have a bunch of new courses, hands-on labs, and lab challenges on AWS, Azure, and Google Cloud, but we also have three new courses on Red Hat, th...

Read more
  • agile
  • AWS
  • Azure
  • Google Cloud Platform
  • Linux
  • programming
  • red hat
  • scrum
Alisha Reyes
Alisha Reyes
— December 24, 2019

Cloud Academy’s Blog Digest: Azure Best Practices, 6 Reasons You Should Get AWS Certified, Google Cloud Certification Prep, and more

Happy Holidays from Cloud Academy We hope you have a wonderful holiday season filled with family, friends, and plenty of food. Here at Cloud Academy, we are thankful for our amazing customer like you.  Since this time of year can be stressful, we’re sharing a few of our latest article...

Read more
  • AWS
  • azure best practices
  • blog digest
  • Cloud Academy
  • Google Cloud
Guy Hummel
— December 12, 2019

Google Cloud Platform Certification: Preparation and Prerequisites

Google Cloud Platform (GCP) has evolved from being a niche player to a serious competitor to Amazon Web Services and Microsoft Azure. In 2019, research firm Gartner placed Google in the Leaders quadrant in its Magic Quadrant for Cloud Infrastructure as a Service for the second consecuti...

Read more
  • AWS
  • Azure
  • Google Cloud Platform
Alisha Reyes
Alisha Reyes
— December 10, 2019

New Lab Challenges: Push Your Skills to the Next Level

Build hands-on experience using real accounts on AWS, Azure, Google Cloud Platform, and more Meaningful cloud skills require more than book knowledge. Hands-on experience is required to translate knowledge into real-world results. We see this time and time again in studies about how pe...

Read more
  • AWS
  • Azure
  • Google Cloud
  • hands-on
  • labs
Alisha Reyes
Alisha Reyes
— December 5, 2019

New on Cloud Academy: AWS Solution Architect Lab Challenge, Azure Hands-on Labs, Foundation Certificate in Cyber Security, and Much More

Now that Thanksgiving is over and the craziness of Black Friday has died down, it's now time for the busiest season of the year. Whether you're a last-minute shopper or you already have your shopping done, the holidays bring so much more excitement than any other time of year. Since our...

Read more
  • AWS
  • AWS solution architect
  • AZ-203
  • Azure
  • cyber security
  • FCCS
  • Foundation Certificate in Cyber Security
  • Google Cloud Platform
  • Kubernetes
Cloud Academy Team
— December 4, 2019

Understanding Enterprise Cloud Migration

What is enterprise cloud migration? Cloud migration is about moving your data, applications, and even infrastructure from your on-premises computers or infrastructure to a virtual pool of on-demand, shared resources that offer compute, storage, and network services at scale. Why d...

Read more
  • AWS
  • Azure
  • Data Migration
Wendy Dessler
Wendy Dessler
— November 27, 2019

6 Reasons Why You Should Get an AWS Certification This Year

In the past decade, the rise of cloud computing has been undeniable. Businesses of all sizes are moving their infrastructure and applications to the cloud. This is partly because the cloud allows businesses and their employees to access important information from just about anywhere. ...

Read more
  • AWS
  • Certifications
  • certified
Andrea Colangelo
— November 26, 2019

AWS Regions and Availability Zones: The Simplest Explanation You Will Ever Find Around

The basics of AWS Regions and Availability Zones We’re going to treat this article as a sort of AWS 101 — it’ll be a quick primer on AWS Regions and Availability Zones that will be useful for understanding the basics of how AWS infrastructure is organized. We’ll define each section,...

Read more
  • AWS
Dzenan Dzevlan
— November 20, 2019

Application Load Balancer vs. Classic Load Balancer

What is an Elastic Load Balancer? This post covers basics of what an Elastic Load Balancer is, and two of its examples: Application Load Balancers and Classic Load Balancers. For additional information — including a comparison that explains Network Load Balancers — check out our post o...

Read more
  • ALB
  • Application Load Balancer
  • AWS
  • Elastic Load Balancer
  • ELB
Albert Qian
Albert Qian
— November 13, 2019

Advantages and Disadvantages of Microservices Architecture

What are microservices? Let's start our discussion by setting a foundation of what microservices are. Microservices are a way of breaking large software projects into loosely coupled modules, which communicate with each other through simple Application Programming Interfaces (APIs). ...

Read more
  • AWS
  • Docker
  • Kubernetes
  • Microservices
Nisar Ahmad
Nisar Ahmad
— November 12, 2019

Kubernetes Services: AWS vs. Azure vs. Google Cloud

Kubernetes is a popular open-source container orchestration platform that allows us to deploy and manage multi-container applications at scale. Businesses are rapidly adopting this revolutionary technology to modernize their applications. Cloud service providers — such as Amazon Web Ser...

Read more
  • AWS
  • Azure
  • Google Cloud
  • Kubernetes