CyberArk Conjur AWS Authenticator: Securing AWS Environments

Businesses these days are integrating cloud landscapes like never before. For this modern problem, CyberArk Conjur's AWS authenticator is providing a modern solution that enables AWS resources like EC2 instances, Lambda functions, and ECS tasks. This removes the setbacks of static credentials by seamlessly authenticating and retrieving data.

Setbacks in Traditional Methods

One of the biggest challenges with traditional methods is dealing with credentials that are static and permanent in nature. Since these credentials are part of applications and infrastructure it creates a lacuna, leading to exposing sensitive data and making overall managing and protecting credentials difficult.

With organizations moving towards adopting dynamic cloud environments, there is an urgent need for a more robust, automated, and secure solution. The CyberArk Conjur AWS Authentication Solution perfectly fills in the gap.

CyberArk Conjur AWS Authenticator: An Introduction

The Conjur AWS Authenticator is designed to address credential security challenges by making the best use of AWS's inherent identity verification mechanisms.

Let us dive deeper into how it is transforming secret management solutions:

How Conjur AWS Authenticator Works?

AWS Identity Verification:

Every AWS resource generates an Instance Identity Document (IID), a signed metadata file that confirms the identity and authenticity of the resource. Since this document is produced by AWS it authenticates that it can be trusted.

Authentication Process:

The authentication process involves the following three steps -

Submission: The resource sends its IID to the Conjur AWS Authenticator.
Validation: Conjur verifies the IID against AWS’s Security Token Service (STS) to confirm its authenticity.
Issue Token: Following successful IID validation, Conjur issues a temporary access token that can be used by AWS resources to gain access to particular secrets specified by the policy.

Secure & Dynamic Secret Access:

The issued temporary token allows AWS resources to access secrets securely that are stored in Conjur based on the policy, formed indeed to stick to strict access control. Thus minimizing risk and simplifying credential management.

What are the Supported AWS Services?

EC2 Instances: Securely authenticate virtual machines hosted on AWS.
ECS Tasks: Enable containerized applications running on AWS ECS (both Fargate and EC2 launch types) to retrieve secrets.
Lambda Functions: Serverless functions are used here to dynamically access the required credentials

Setting up the IAM Authenticator in Conjur?

Step1: IAM Authenticator Configuration is the first step in the process

1.1 Define and Load the IAM Authenticator Policy

a. Create the policy file “ iam-authN.yml”. To enable AWS authentication define the authentication policy.

- !policy

id: aws-authn

body:

- !webservice

- !group clients

- !permit

role: !group clients

privilege: [authenticate]

resource: !webservice

b. Then, load the policy :

Use the following command to load the policy into Conjur

conjur policy load -b root -f /path/to/file/authn-iam.yml

Step 2: Define a workload identity (host) in Conjur for the AWS resource

Create a host.yml file for defining the AWS resource identity:

- !policy

id: myspace

body:

- &variables

- !variable database/username

- !variable database/password

# Form a group that will have exclusive right or permission to retrieve variables

- !group secrets-users

# Name the group as `secrets-users` group and permit them to retrieve variables

- !permit

role: !group secrets-users

privilege: [ read, execute ]

resource: *variables

# Create a layer where the application’s hosts can be held

- !layer

# The host ID must align with the AWS ARN of the role intended for authentication.

- !host 011915987442/MyApp

# Now grant access to our host to be a part of this layer

- !grant

role: !layer

member: !host 011915987442/MyApp

#Grant permission to the host in our layer to access variables.

- !grant

member: !layer

role: !group secrets-users

# Grant the host permission to authenticate via the IAM Authenticator.

- !grant

role: !group conjur/authn-iam/prod/clients

member: !host myspace/011915987442/MyApp

These steps ensures that only trusted AWS resources are authenticate and retrieve secrets in secure and safe manner.

Step 3: Enable the IAM Authenticator

Using allowlist in conjur you can enable the IAM authenticator

Why is this important?

Adopting the Conjur AWS Authenticator brings several benefits:

• Enhanced Security by eliminating static credentials and leveraging dynamic, temporary tokens.

• Operational Efficiency by automating secret retrieval, reducing the overhead of manual credential management.

• Scalability by seamlessly integrating with AWS services, supporting modern DevOps and microservices architectures.

If your business is looking to enhance AWS infrastructure security through CyberArk Conjur AWS Authentication then IDMEXPRESS is here for you. Contact Us today for a consultation.