AWS Account Security Features

AWS Credentials

AWS uses several types of credentials for authentication. These include passwords, cryptographic keys, digital signatures, and certificates. AWS also provides the option of requiring multi-factor authentication (MFA) to log into your AWS account or IAM user accounts.

Following are the various AWS credentials and their uses.

Passwords: Password is used to log into AWS account, IAM account, discussion forum, and the support center. It can be created during signup to the AWS account for the root admin account. All other user account passwords will be specified by an administrator with the option to allow to change on the first time used by IAM user. Passwords can be changed any time using the security credentials page.

AWS Multi-Factor Authentication (MFA): AWS Multi-Factor Authentication (MFA) is additional optional feature security for accessing AWS services. It requires a six-digit single-use code along with a user name and password to access AWS Account settings or AWS services and resources. This is called multi-factor authentication because more than one authentication factor is checked before access is granted: a password (something you know) and the precise code from your authentication device. it can be enabled using an MFA device for an AWS Account as well as for the users that have created using AWS IAM. AWS MFA supports the use of both hardware tokens and virtual MFA devices. Virtual MFA devices use the same protocols as the physical MFA devices but can run on any mobile hardware device, including a smartphone. A virtual MFA device uses a software application that generates six-digit authentication codes that are compatible with the Time-Based One-Time Password (TOTP) standard. Most virtual MFA applications allow hosting more than one virtual MFA device, which makes them more convenient than hardware MFA devices. However, you should be Amazon Web Services: You can also enforce MFA authentication for AWS service APIs in order to provide an extra layer of protection over powerful or privileged actions such as terminating Amazon EC2 instances or reading sensitive data stored in Amazon S3. You do this by adding an MFA-authentication requirement to an IAM access policy. You can attach these access policies to IAM users, IAM groups, or resources that support Access Control Lists (ACLs) like Amazon S3 buckets, SQS queues, and SNS topics. It is easy to obtain hardware tokens from a participating third-party provider or virtual MFA applications from an AppStore and to set it up for use via the AWS website. 

Access Keys: Access key is a digitally signed request which must be included to access AWS APIs (using the AWS SDK, CLI, or REST/Query APIs) to verify the identity of the requestor. Aj AWS users calculate the digital signature using a cryptographic hash function. The input to the hash function, in this case, includes the text of the request and secret access key. It will be calculated automatically by AWS on using any of the AWS SDKs to generate requests otherwise, you can have your application calculate it and include it in your REST or Query requests.