Create a simple flask Rest API, containerise it using docker and deploy it as service in Elastic Container Service — AWS provides container services to deploy and run container applications. One of the services is Elastic Container Service i.e. ECS. In this article, we will see how to create a sample flask RestAPI, containerize it with docker and deploy this docker image to ECS. Before we start, lets define few…

Push CloudTrail events to a centralized AWS account using CloudWatch event bus and automatically tag resources on creation. — In my previous articles, I had been emphasizing on using a centralized auditor account to enforce best practices and governance in your organization. The auditor account can access resources in linked accounts by assuming IAM role. …

Detect and remove unused IAM credentials. — To increase the security of our AWS account, we need to remove IAM user credentials (that is, passwords and access keys) that are not needed anymore. Removing unused credentials is one of the best practices for IAM. …

Detect unintended IAM access, revoke unauthorized user’s IAM access and send notification to your slack channel. — In my previous articles, I covered programming basic IAM features. In this article, we will see how to detect unintended IAM access, revoke unauthorized user’s IAM access and send notification to your slack channel. First of all, we will create a slack app. As shown below, Go to https://api.slack.com/ —…

Assume an IAM role in trusting AWS account from trusted AWS account and retrieve IAM group names attached to a given user. — In the previous article, we saw how to create an IAM role and attach trust relationship policy in trusting account. In this article, we will see how to assume that role from trusted account, so that an IAM user or role in trusted account gets access to resources in trusting…

Create an IAM role to delegate permissions to an AWS Service or an IAM user of another AWS account. — In this article, we will see how to create an IAM role to delegate permissions to an AWS service and an IAM user of another AWS account. AWS IAM roles are very powerful. We should always try to use roles instead of access keys as much as possible. Import boto3…

Create an IAM programmatic user and attach a managed or custom policy and email credentials to user. — In Part 1 , we discussed how to create AWS IAM Console user with login profile. In this section, we will discuss how to create programmatic IAM user. Programmatic user can be used from AWS CLI and SDKs but it can not be used to login to AWS web console. …

Create an IAM console user, attach a managed or custom policy, add user to a group and send credentials via email — Before starting, lets define few terms. IAM: is an Identity and Access Management Service provided by AWS. For more details, please read here. boto3: is a python SDK for AWS. For more details, please read here. AWS lambda: lambda is an AWS serverless service that helps you run your code…