Emergency Access Account

Question

Hi,

I have AWS environment which uses IAM Identity Centre. Users are created in Active Directory and synced across AWS and they can access AWS.
I want to create emergency access account to access AWS if Active Directory goes down. I checked the link https://docs.aws.amazon.com/singlesignon/latest/userguide/emergency-access.html but this shows to create Emergency Account if IAM Identity Centre goes down. I want such accounts which can access even if Active Directory goes down. I am thinking to create IAM users with administrative access. What is the best way to create this emergency access account in case of Active Directory Failure?

Accepted Answer

Hi Manish

Break-Glass accounts are a key part of managing your AWS organisation.  
I've found an IAM account the best way to protect against Azure AD issues.  
As you say create a user and put in a group with the managed Admin policy applied is a simple way around this.

The only think I would point out is to make sure you store the credentials (password and MFA) in a location that doesn't also rely on Azure AD. maybe 3rd party password manager.  
I've seen several people store in a security solution that requires AD permissions to get the break-glass credentials.

The following doc discusses your situation and could be a good place to start.  
https://docs.aws.amazon.com/whitepapers/latest/organizing-your-aws-environment/break-glass-access.html

Hope this helps.

Answer

Hello Manish,
I think the below links might be able to help with your issues - 
https://aws.amazon.com/blogs/modernizing-with-aws/automate-disaster-recovery-for-your-self-managed-active-directory-on-aws/
https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_best_practices.html
Please let me know if u need more help 
Thanks

Emergency Access Account

Contenuto pertinente