Free AWS Bootcamp: Week 0 - Part 2
Tags: aws, budget, freecredits, cloud
Published: 2023-02-18 02:23:44

Welcome Back!
This is part 2 of the Week 0 AWS Free AWS bootcamp blogpost, To review Part 1 please click the link [here](https://dev.to/msaghu/free-aws-bootcamp-week-1-part-1-ada).

Our main targets/goals for this part of the Week are:
1. Securing our root user account and creating an organisation and  IAM users.
2. Creating a budget and billing alarms.

So let's begin:

---

## Securing our root user account
Before we learn about IAM users, lets first define what a root user account is.

**What is a root user?**
- When we create our very first Amazon Web Services(AWS) account, we have a single sign-in that has complete access to all AWS services and resources. This is the **AWS root user account.**
- After creating our IAM user, and to ensure the security of our account, we will deactivate the access keys for the root user.**(describe this process)**

<u>**Step 1 - MFA** </u>
_We can start by adding MFA to our root user account.
We will choose IAM from the AWS console. Since we are still logged in as the root user, the console will give us a warning regarding setting MFA for the user._

![MFA warning](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/s724ssyl36nqro9knpuv.png) 

- Select the MFA device, for purposes of this lab, I will be using the Google Authenticator App.

![Select the MFA device](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/trhsauh6fkbpdbvtyhda.png)

- Then we will follow the prompt, to open the QR code then scan from my authenticator app from my phone/type in the access key provided on the AWS console.

- Success!

<u>**Step 2 - Organizations**</u>
_We will be creating our organization and adding in 2 member accounts, where we will create one of the member accounts and invite the other account to join the organization. We will also set **allow list** that permits only the services we have explicitly listed. Any new services added by AWS will not be allowed/added until the administrator specifically allows it._

**What is an Organization**

An Organization is a free account management service that enables us to consolidate and centrally manage multiple AWS accounts. Enables us to apply security across the accounts using Service Control Policies(SCPs) and have consolidated billing.

- In the AWS console, type then choose **AWS Organizations.** 

- Choose AWS organizations and then **Create an Organization**. (This creates an organization that has all features enabled, by default.). We now have an organization with our root account as its only member. This will now be the management account.

![AWS Organizations](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zuahnay9groesx8pozeg.png)

- We can now create an account and add it to our Organization (there is also an option where we add existing accounts) accounts to join our organization. This is now referred to as a member account.

![Image 5 - Creating an AWS account and adding to the Organization](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wj9xqmbq51a1i3g5fl6a.png)

![Image 6 - Account creation](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cicsbh3dyxekcdme9mth.png)

- We will now create an Organizational unit, which we will populate by placing our member account.

- On the Organizations console, choose the check box next to the Root container and click into it. This will open the options in which you can then choose the **Children** tab, then choose **Actions** and then under **Organizational units**, choose **Create new.**

![Image 7](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/b15hkm82pk970sdnovvr.png)

- Next, we want to move our member account into our OU, we do this by choosing the check box next to the member account and clicking on the name, in the next console, clock on **move**, then we will see the newly created OU, we will choose the radio button next to it then choose, move AWS account.

**Step 3 - First time Member sign in**

- To perform actions in the member account that we created above, we need to access it/log in to the member account. However since its a newly created accounted, its credentials are make it a form of root account(but its still a member account in the organization).

- We will go back to the login page and enter the member email address(in the root account section) and in the next section, choose **Forgot password?** 

![Image 9 - Member account](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pc8m1q5gfhqvtu4u0swi.png)

- A link will be set to the email address that you provided above and we will be able to reset our password and the Success, we can now log in to our member account!

**Step 4 - Roles**
To perform tasks in the member account, I then decided to create a role.

- We will log in as the root management account user, we will choose **IAM** from the AWS console, then on the left hand navigation bar, we will choose **Policies**.

- We will then choose **Create policy** , then choose **Choose a service**, then type STS into the searchbox and then choose the STS option. In the **Actions** section, type assume in the search box  the list, and then choose the **AssumeRole** option. In the Resources section, choose **Specific**, choose **Add ARN to restrict access**, and then put in the member account number and the name of the role that you created in the previous section (AWS recommended naming it OrganizationAccountAccessRole).

![Image 10 - Creating a policy ](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bu5kt4tnt9can41ymodz.png)

![Image 11](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/98hlrbf2akwpzky8q5z9.png)
![Image 8 - Create role](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/36feebigsdy5i9er5euv.png)

- We can also enable MFA for the account by expanding the Request conditions section.

- Choose review policy then enter a name for the policy then choose **Create policy.**

- We will now attach the policy to a group.

**Step  5 - Enabling IAM Identity Center**

To enable IAM Identity Center, the account must be managed by AWS Organizations. IAM Identity Center makes it easy to connect an existing directory or use the built-in Identity Center directory to manage and/or create user and groups, and manage their  access to AWS accounts and cloud applications.

- We will now sign in as the root management account user, since we have already created an AWS Organization. In the console, search for IAM Identity Center. Under **Enable IAM Identity Center**, choose **Enable**.

- We will now choose our identity source, this is where our users and groups will be managed. Since we are just staring out, Identity Center directory has been automatically configured as our default identity source. _(We can also import from Active Directory )_

- In the Identity Center Console, we will choose **Add Users** to create a user. We can specify the user details so that we receive an email with the password setup instructions. follow the prompts.

- We will now enable our user to have administrative access to the root management account.

- In the Identity Center Console, we will choose under **Multi-account permissions**, choose **Permission sets**. Choose **Create permission set**. For Step 1: Select permission set type, on the Select permission set type page, keep the default settings and choose Next. The default settings grant full access to AWS services and resources using the AdministratorAccess predefined permission set.

![Image 13](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qkjgxk14g6x6dxm2633v.png)

- For Step 2: Specify permission set details, on the Specify permission set details page, keep the default settings and choose Next. The default setting limits your session to one hour.

![Image 14 - Step 2](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cvvlpbhzkytzx3c2xyti.png)

- For Step 3: Review and create, on the Review and create page, do the following:
Review the permission set type and confirm that it is AdministratorAccess.
Review the AWS managed policy and confirm that it is AdministratorAccess.
Choose Create.

![Image 15](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2yq3f48t5373gnpxbdqp.png)

- In the Identity Center Console, under**Multi-account permissions**, choose **AWS accounts**. Here, we will see a tree view list of our organization. We will select the check box next to the management account. Choose **Assign users or groups.**

![Image 16](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xfe8yl0w3e4ks4fyj8wg.png)

- **Step 1: Select users and groups**, on the **Assign users and groups to "AWS-account-name"** page, then: On the **Users** tab, select the user to whom you want to grant administrative permissions.
To filter the results, start typing the name of the user that you want in the search box.
After you confirm that the correct user is selected, choose **Next**.

- For **Step 2: Select permission sets**, on the **Assign permission sets to "AWS-account-name"** page, under **Permission sets**, select the **AdministratorAccess** permission set. Choose Next.

- For **Step 3: Review and Submit**, on the **Review and submit assignments to "AWS-account-name"** page, do the following. Review the selected user and permission set. After you confirm that the correct user is assigned to the **AdministratorAccess** permission set, choose **Submit**.

![Image 17](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wokewf9p4cn2m7ot5qvn.png)

- On the Dashboard page, under Settings summary, copy the AWS access portal URL. Open a separate browser, paste in the AWS access portal URL that you copied, and press Enter. An AWS account icon will appear in the portal.

---

## Creating a budget and billing alarms

For the purposes of security and to adopt AWS Best practices for our account, to allow access to our billing information without using the root credentials we will need to enable IAM access. This allows other users (non-root) to access billing information in the management account. This approach provides individual sign-in information for each user, and you can grant each user only the permissions they need to work with your account. 

To stay within the free tier, make sure you only have 2 budgets per account. 

- 





---

**Tips and tricks**

- For the purposes of this lab, I am using a trick that I learnt where I create new email addresses using **examplelab+1@gmail.com** so that I can receive all emails in the same folder for easier management.

<u>Security of the root account</u>

- Make a secure backup of the QR code or secret configuration key, or make sure that you enable multiple virtual MFA devices for your account. A virtual MFA device might become unavailable, for example, if you lose the smartphone where the virtual MFA device is hosted). If that happens, you will not be able to sign in to your account and you will have to contact customer service to remove MFA protection for the account.
- AWS recommends that we do not create access keys for the root user account as it provides full access to all your account's resources including the billing information.
- AWS also recommends that we do not use the root account for day to day activities. To see the full list of task that **WOULD REQUIRE AN IAM USER** refer to this [link](https://docs.aws.amazon.com/accounts/latest/reference/root-user-tasks.html).

---
**Resources**
1. [AWS Well Architected Labs](https://wellarchitectedlabs.com/security/100_labs/100_aws_account_and_root_user/1_intro/)

2. [AWS Organizations Documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_tutorials_basic.html)

3. [IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html)

4. [Read more on AWS Control Tower](https://docs.aws.amazon.com/controltower/)

5. [AWS Organizations & AWS IAM Tutorial For Beginners by Cloud Security Podcast](https://www.youtube.com/watch?v=4EMWBYVggQI&list=PLBfufR7vyJJ7k25byhRXJldB5AiwgNnWv&index=15)