Establish AWS IAM Policy

[erniep278]

Overview

Establish an IAM policy for AWS with best security practices and take corrective actions to be compliant with the policy.

Action Items

First thing is to create an IAM Policy framework to follow. Then the following would happen. Adjustments to tasks can be made as needed.

1. Create a gap analysis of the current IAM setup to the new IAM policy.

2. Assess the use of the AWS tenant, teams, and AWS resources.

3. Create a plan to address the implementation of the IAM policy without affecting current workloads.

4. Create groups with granular permissions based on needs.

5. Remove/Disable inactive users.

6. Select a scope of users for testing access with new groups and permissions.

7. Assign the scope of users to the new groups to check functionality and permissions are working as designed.

8. Assign remaining users in waves.

Resources/Instructions

Use this for reference:
https://docs.aws.amazon.com/iam/index.html

[JasonEb]

• Should investigate Split the project-leads user group into developer-group, ops-group, and project-leads group #59 and AWS IAM security improvements  devops-security#24 to see if it reflects any of the action items

[ExperimentsInHonesty]

This issue has been replaced with the new devops-security repo.