Iam | Techlist.io

awsJun 30, 20262 min readCurated summary

Accelerate your infrastructure deployments by up to 4x with AWS CloudFormation Express mode | Amazon Web Services

AWS CloudFormation Express mode speeds deployments by marking them complete once resource configuration is applied, rather than waiting for full stabilization checks. AWS says this can reduce deployment times by up to four times, while resources continue becoming operational in the background. It is intended for rapid infrastructure iteration and scenarios where eventual stabilization is acceptable, not workflows requiring resources to be fully ready before proceeding. ## How Express Mode Works - Standard CloudFormation deployments wait for post-configuration stabilization checks. - Express mode completes earlier, immediately after configuration is applied. - Resources continue stabilizing asynchronously. - CloudFormation retries dependent resources that encounter transient provisioning failures. - The provisioning process itself is unchanged; only the point at which deployment completion is reported changes. ## Performance Improvements - Creating an SQS queue with a dead-letter queue took: - Standard mode: 64 seconds - Express mode: up to 10 seconds - Deleting a Lambda function with attached network interfaces took: - Standard mode: 20–30 minutes - Express mode: up to 10 seconds in AWS’s benchmark ## Best Use Cases - Iteratively building infrastructure one component at a time. - Testing individual application components. - AI-assisted infrastructure development requiring sub-minute feedback. - Production workflows that can tolerate resources stabilizing after deployment completion. ## Enabling Express Mode - In the AWS Console, select **Enable** under stack deployment options. - With the CLI or SDKs, set the deployment configuration mode to `EXPRESS`: ```bash aws cloudformation create-stack \ --stack-name my-app \ --template-body file://template.yaml \ --deployment-config '{"mode": "EXPRESS", "disableRollback": true}' ``` - AWS CDK supports: ```bash cdk deploy --express ``` - No CloudFormation template changes are required. - Express mode supports existing templates, change sets, nested stacks, and IaC or AI tools such as Kiro. - Enabling it on a parent stack also applies it to nested stacks. ## Rollback and Operational Considerations - Rollback is disabled by default in Express mode to maximize iteration speed. - For production use, rollback can be restored with `"disableRollback": false`. - Teams should otherwise provide monitoring and cleanup procedures for failed deployments. - IAM templates should continue following least-privilege principles. ## Availability - Express mode is available at no additional cost in all AWS commercial Regions. - AWS recommends standard deployment behavior when resources must be fully operational before traffic shifting or testing. For fast development and AI-driven infrastructure iteration, Express mode is a useful optimization. Use it selectively, while retaining standard mode—or explicitly enabling rollback—when deployment readiness and failure recovery are critical.

Read original

Iam Aws Lambda Infrastructure As Code Aws Cli+4

awsJun 16, 20263 min readCurated summary

Amazon S3 annotations: attach rich, queryable context directly to your objects | Amazon Web Services

Amazon S3 annotations let organizations attach rich, mutable context directly to objects without rewriting the underlying data. Each object can have up to 1,000 named annotations, with a combined limit of 1 GB, in formats such as JSON, XML, YAML, or plain text. The annotations move with objects during copying and replication, can be queried through S3 Metadata tables, and are intended to support large-scale analytics and AI-driven workflows. ## Richer Metadata at Object Scale - Annotations address limitations of existing S3 metadata features: - System metadata describes properties such as size and storage class. - Object tags support operational tasks but are limited to 10 immutable tags. - User-defined metadata is limited to approximately 2 KB of headers and must be supplied during upload. - Annotations can be modified or deleted independently without rewriting the object. - Each annotation has a unique name and can hold up to 1 MB, with up to 1 GB total per object. - Supported content includes structured formats such as JSON, XML, and YAML, as well as plain text. ## Supporting AI and Industry Workflows - AI-generated transcripts, summaries, classifications, ratings, and technical specifications can remain attached to the relevant data. - Media companies can store transcripts, moderation results, subtitles, licensing information, and media specifications alongside video assets. - Financial institutions can attach investment summaries and sentiment analysis to research documents for autonomous discovery. - Life sciences organizations can add regulatory status, cohort information, and approval chains to clinical-trial data. - Annotations remain available for objects in archival storage classes without restoring the objects or paying retrieval charges. ## Object Lifecycle and Synchronization - Annotations automatically move with objects during copy, replication, and cross-Region transfers. - S3 removes annotations when the associated object is deleted. - This reduces dependence on separate metadata databases or sidecar files and avoids synchronization overhead. - Different teams or enrichment processes can maintain separate annotations on the same object without overwriting one another. ## Working with Annotations - IAM or bucket policies must grant: - `s3:PutObjectAnnotation` - `s3:GetObjectAnnotation` - The main APIs are: - `PutObjectAnnotation` to create or update an annotation - `GetObjectAnnotation` to retrieve one annotation - `ListObjectAnnotations` to view all annotations on an object - `DeleteObjectAnnotation` to remove an annotation - Reusing an annotation name with `PutObjectAnnotation` updates its content. - For multipart uploads, annotations are added after the upload is completed. - The example uses separate `mediainfo` JSON and `ai_summary` text annotations on a video object. ## Querying Through S3 Metadata - When S3 Metadata is enabled, annotations automatically populate managed annotation tables. - These tables can be queried with Amazon Athena and other analytics engines. - The S3 Tables MCP server provides a standardized interface for AI models and agents to query annotation data using natural-language workflows. - This enables discovery across large collections of S3 objects without retrieving the objects themselves. S3 annotations are most useful when object context is large, frequently updated, and needed for cross-object search or AI automation. Organizations should use them to keep business and machine-generated metadata directly associated with the data while using S3 Metadata tables for scalable querying.

Read original

Iam AI Agents Amazon S3 Json+3

awsMay 6, 20263 min readCurated summary

The AWS MCP Server is now generally available | Amazon Web Services

The AWS MCP Server is now generally available as a managed way for AI agents to access AWS securely through IAM-authenticated tools. It combines live AWS documentation, access to more than 15,000 API operations, and sandboxed scripting so agents can produce more current, efficient, and production-ready results. The post concludes that this solves major limitations of model-only AWS assistance without granting agents unrestricted credentials. ## Why AI Agents Struggle with AWS - Models may lack knowledge of recently launched services such as Amazon S3 Vectors, Aurora DSQL, and Bedrock AgentCore. - Agents often default to the AWS CLI instead of AWS CDK or CloudFormation. - Generated IAM policies are frequently broader than necessary. - The resulting infrastructure may work in demos but fail production standards. ## Core AWS MCP Server Tools - `call_aws` can execute more than 15,000 AWS API operations using the user’s existing IAM credentials. - `search_documentation` and `read_documentation` retrieve current AWS documentation and best practices at query time. - The compact tool set reduces model context usage and is intended to support newly launched APIs within days. ## General Availability Improvements - IAM context keys allow fine-grained access control through standard IAM policies without requiring a separate server permission. - Documentation retrieval no longer requires authentication. - Reduced token consumption improves complex, multi-step workflows. - The `run_script` tool executes short Python scripts in a server-side sandbox. - The sandbox inherits IAM permissions. - It has no network access or access to the user’s local filesystem and shell. - It can combine multiple API calls, filter results, and calculate outputs in one round trip. ## Skills and AWS Best Practices - Skills replace Agent SOPs with curated guidance for common AWS tasks. - AWS service teams contribute and maintain the Skills. - They help agents avoid mistakes, use validated patterns, reduce hallucinations, and consume fewer tokens. - Keeping the tool list small makes agent behavior more predictable. ## Enterprise Security and Observability - IAM policies and Service Control Policies can separate human permissions from agent permissions. - For example, a user may perform write operations while the MCP server is restricted to read-only access. - CloudWatch metrics under the `AWS-MCP` namespace distinguish agent activity from direct human calls. - AWS CloudTrail records all API calls for auditing and compliance. ## Demonstration with Claude Code - Without the MCP Server, Claude Opus 4.6 suggested several valid ways to store embeddings on S3 but missed Amazon S3 Vectors because the service launched after its training cutoff. - With the MCP Server, Claude Code searched current AWS documentation and correctly identified S3 Vectors. - Claude Code can connect through the open-source `mcp-proxy-for-aws`, which bridges local IAM credentials and MCP’s OAuth 2.1 requirement. - The server works with Claude Code, Kiro, Cursor, Codex, and other MCP-compatible clients. ## Availability and Cost - The service is available in US East (N. Virginia) and Europe (Frankfurt). - It can make API calls across AWS Regions. - There is no additional charge for the MCP Server; users pay for AWS resources and applicable data transfer. The AWS MCP Server is a practical foundation for giving agents current AWS knowledge and controlled operational access. Teams should pair it with narrowly scoped IAM policies, read-only defaults where possible, and CloudWatch or CloudTrail monitoring.

Read original

Iam Model Context Protocol Python AWS+4

figmaSep 1, 20213 min readCurated summary

Inside Figma: getting out of the (secure) shell | Figma Blog

Figma replaced its traditional bastion-host SSH model with a zero-trust shell-access system built on AWS Systems Manager Session Manager. The design combines Okta, AWS SSO, phishing-resistant WebAuthn MFA, short-lived IAM credentials, and centralized session logging. This eliminated exposed SSH ports while making access easier to manage, audit, and roll out incrementally. ## Why Figma moved beyond bastion hosts - Bastion hosts became increasingly difficult and time-consuming to secure and manage as Figma scaled. - Because bastions are critical security controls, attackers may target them to gain access to production systems and user data. - Figma’s replacement aimed to provide: - A smooth and reliable developer experience - Zero-trust networking - Strong authentication and phishing-resistant MFA - Short-lived, automatically rotating credentials - Centralized auditing and session tracing - Minimal operational maintenance - Incremental, backwards-compatible adoption ## Choosing AWS Systems Manager - Figma evaluated commercial products such as Okta Advanced Server Access. - These products lacked flexibility for existing workflows, were not always available to Figma, and could introduce external availability dependencies. - Since Figma already relied heavily on AWS, the team built a proof of concept using AWS services. - Systems Manager Session Manager provides: - Authenticated, encrypted TLS connections between users and managed instances - Interactive shells and command execution - SSH tunneling when needed - Access to EC2 and ECS without exposing SSH ports or making instances externally reachable - Centralized permission management through IAM roles ## SSO, authentication, and access control - Okta integrates with AWS SSO to provide centrally managed authentication. - Figma requires device trust and WebAuthn-based multi-factor authentication. - Authenticated users assume dedicated, minimally privileged IAM roles. - AWS access tokens are short-lived, limiting the impact of stolen credentials. - Session Manager records session transcripts in an encrypted S3 bucket for investigation and auditing. - Okta group synchronization makes access management straightforward for IT teams. - Engineers can start sessions either through the AWS Systems Manager console or through Figma’s custom command-line tool. ## Mitigating AWS SSO phishing risks - AWS SSO can be abused through device-code phishing, where attackers trick users into approving an authorization request created by the attacker. - Figma added monitoring and alerts to detect suspicious authentication activity. - Engineers are also expected to treat unexpected SSO authorization pages as suspicious. ## Setting up Session Manager - AWS provides configuration guides for both EC2 and ECS. - Figma’s approach uses Session Manager as the secure access layer while relying on IAM policies, SSO groups, and encrypted logging to control and audit sessions. - The system preserves existing workflows where necessary while removing the need for publicly accessible SSH infrastructure. Figma’s experience suggests that teams already invested in AWS can build a practical zero-trust shell-access system with native services. Session Manager, combined with strong SSO controls, least-privilege IAM, short-lived credentials, and centralized logging, offers a simpler and more secure alternative to bastion-based SSH.

Read original

Iam Zero Trust Security Ssh Okta+3

datadogSep 20, 20173 min readCurated summary

Secure (and usable) multi-AWS account IAM setup

Managing multiple AWS accounts increases billing, compliance, and operational complexity, but it provides valuable security boundaries between workloads. The post proposes a centralized IAM design in which users exist in only one account, receive minimal default permissions, and temporarily assume narrowly scoped roles in target accounts. MFA and short-lived credentials further limit the impact of compromised credentials, although the approach is constrained to roughly ten accounts by IAM group limitations. ## Why Use Multiple AWS Accounts? - Accounts isolate workloads at several levels: - **Network:** VPCs are separate unless explicitly peered. - **API access:** A compromised account cannot access others without delegated roles. - **Compute and billing:** Per-account spending limits, billing alerts, and CloudTrail monitoring can contain or reveal abuse such as cryptocurrency mining. - The main challenge is gaining these security benefits without creating unmanageable administrative overhead. - The proposed pattern is better suited to production environments than development setups where every developer may have a separate account. - Current IAM group limitations restrict the design to approximately ten accounts. ## Centralized IAM User Management - Each IAM user should exist in only one account. - Centralizing users makes onboarding, offboarding, password policies, and auditing easier. - Other accounts can be monitored for unexpected IAM user creation, which should generally never occur. - Users receive only the permissions needed to manage their own authentication settings. ## Why Use IAM Instead of SSO? - SSO would centralize authentication through an existing identity provider. - However, the post argues that SSO can limit the ability to apply MFA protection precisely to privileged operations. - Since MFA is central to the proposed privilege-escalation model, standalone IAM users are retained despite their administrative drawbacks. ## Minimal Default Permissions By default, users should be able to: - View their own IAM record. - Change their console password. - Create, update, or delete their own API credentials. - Create their own MFA device. They should have no meaningful access to other AWS APIs. This limits the blast radius of stolen usernames, passwords, or API keys: without the user’s MFA device, an attacker can generally do little more than inspect the compromised user’s record. ## Temporary Privilege Through Role Assumption - Users perform privileged work by calling `sts:AssumeRole` in the target account. - Assuming a role provides temporary credentials and a session token. - Credentials have a short lifetime, normally no more than one hour by default. - This resembles the Unix `sudo` model: users begin with restricted permissions and explicitly elevate privileges when necessary. ## MFA-Protected Privilege Escalation A role assumption should succeed only when both conditions are met: - The user has an active MFA device and can authenticate with it. - The user belongs to a group authorized to assume the requested role. MFA does not eliminate compromise risk, but it makes stolen API credentials substantially less useful and limits the damage they can cause without the corresponding MFA device. ## Privileges Grouped by Operational Topic - Administrative capabilities are divided into roles based on responsibility rather than assigning broad account-wide permissions. - Example roles include: - A **VPC role** for network configuration. - An **EC2 role** for instance management. - An **S3 role** for storage administration. - Users can then be mapped to groups and roles according to their job responsibilities, making permissions easier to understand and maintain. ## Practical Recommendation Use multiple AWS accounts as deliberate security boundaries, but centralize IAM users, keep their baseline permissions minimal, require MFA for role assumption, and grant temporary, topic-specific roles. This provides strong isolation while keeping privilege management manageable, particularly for production environments with a limited number of accounts.

Read original

Iam AWS Api Security Mfa+4