Skip to content

Commit 05af12d

Browse files
milldrosterman
milldr
and
osterman
authored
chore: Improve SuperAdmin docs (#747)
Co-authored-by: Erik Osterman (CEO @ Cloud Posse) <erik@cloudposse.com>
1 parent 4d7aab4 commit 05af12d

File tree

1 file changed

+68
-147
lines changed

1 file changed

+68
-147
lines changed

‎docs/layers/accounts/tutorials/how-to-create-superadmin-user.mdx

Lines changed: 68 additions & 147 deletions
Original file line numberDiff line numberDiff line change
@@ -5,191 +5,112 @@ sidebar_position: 23
55
description: Create `SuperAdmin` for secure, controlled AWS root access.
66
---
77
import Intro from '@site/src/components/Intro';
8-
import KeyPoints from '@site/src/components/KeyPoints';
8+
import Steps from '@site/src/components/Steps';
9+
import Step from '@site/src/components/Step';
10+
import StepNumber from '@site/src/components/StepNumber';
911

1012
<Intro>
11-
The `SuperAdmin` user is necessary for performing administrative functions that IAM roles cannot, ensuring secure and controlled access to the root account while minimizing risks. These are the step-by-step instructions for creating a `SuperAdmin` user in AWS, including setting permissions, enabling MFA, and securely storing credentials in 1Password.
13+
The `SuperAdmin` user is recommended for performing certain high-risk administrative tasks that modify IAM permissions affecting users on SSO or SAML. We don't recommend making these types of changes with your own SSO or SAML identity because a misconfiguration could lead to account lockout. This guide outlines the steps to create a secure `SuperAdmin` user in AWS, including setting permissions, enabling MFA, and storing credentials safely in 1Password.
1214
</Intro>
1315

14-
[REFARCH-73 - Provision SuperAdmin User for Root Level IAM Management](/layers/accounts/prepare-aws-organization/#create-the-superadmin-iam-user)
15-
16-
### Prerequisites
17-
1816
[Follow the prerequisites steps in the How-to Get Started guide](/layers/project/#0-prerequisites)
1917

20-
## Basic Instructions
21-
22-
Login to the AWS `root` account using the root credentials.
23-
24-
In the IAM console, select "Users" on the sidebar.
25-
26-
1. Click "Add users" button.
27-
1. Enter "SuperAdmin" for "User name". Leave "AWS Management Console access unchecked." Click "Next".
28-
1. Under "Set permissions", select "Attach existing policies directly". A list should appear, from which you should
29-
check "AdministratorAccess". Click "Next".
30-
1. Review and click "Create user".
31-
1. The "Success" page should show you the "Access key ID" and hidden Secret access key" which can be revealed by
32-
clicking "Show". Copy these to your secure credentials storage as you will need them shortly.
33-
1. Click "Close" to return to the IAM console. Select "Users" on the sidebar if it is not already selected. You should
34-
see a list of users. Click the user name "SuperAdmin" (which should be a hyperlink) to take you to the Users ->
35-
SuperAdmin "Summary" page.
36-
1. Click on the "Security credentials" tab. In the 'Multi-Factor Authentication (MFA)' section, click "Assign a virtual
37-
MFA device".
38-
1. Enter a name that corresponds to how you will store the MFA token (e.g. '1password')
39-
1. Select 'Authenticator App' as the MFA device type and click 'Next'.
40-
1. Follow the instructions to set up the MFA device. Store the TOTP key in your secure credentials storage.
41-
1. You should be taken back to the "Security Credentials" tab, but now the "Assigned MFA device" field should have an
42-
ARN like `arn:aws:iam::<account-number>:mfa/SuperAdmin`. Copy the ARN and keep it with the Access Key.
43-
1. Now we need to create an Access Key for CLI access. Click on the "Create Access Key" under "Access Keys".
44-
1. Select "Command Line Interface" and click the "I understand..." checkbox then click 'Next'.
45-
1. Enter a description if you like, such as 'SuperAdmin CLI Access' and click 'Create'.
46-
47-
### Storing SuperAdmin credentials in 1Password
48-
49-
The `SuperAdmin` credentials should be properly stored in 1Password. Relative to other potential 1Password item types,
50-
the most appropriate 1Password item type for these credentials is `login`. Since these are programmatic credentials and
51-
not an actual login with an endpoint from which the website favicon can be retrieved, the icon for this item should be
52-
manually set to the [AWS logo](https://github.com/cryptotradev/vymd-infra/blob/main/docs/img/awspng). Additionally, the
53-
password field should be kept empty. For convenience in retrieving the TOTP code when using Leapp, save `com.leapp.app`
54-
as a website URL.
55-
56-
Set the username to `SuperAdmin`, create fields for the `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and the TOTP
57-
(known as One Time Password field type in 1password) via the AWS virtual MFA device's secret.
58-
59-
Finally, leave a note for this item in the following format:
60-
61-
```
62-
This account's Access Key should be made inactive when not needed.
63-
64-
CURRENT STATUS: ACTIVE
65-
66-
Use this account for API/command line access to administrative functions that IAM roles cannot do, such as provision IAM roles.
67-
68-
This account should not be allowed to log in to the AWS console, and therefore does not have a password.
69-
70-
Root account ID: [AWS ACCOUNT ID]
71-
72-
User ARN arn:aws:iam::[AWS ACCOUNT ID]:user/SuperAdmin
73-
74-
MFA Device ARN arn:aws:iam::[AWS ACCOUNT ID]:mfa/SuperAdmin
75-
76-
```
77-
78-
The resulting entry in 1password should appear as follows:
79-
80-
Hit save once you are done. Once the SuperAdmin credentials need to be disabled, do not forget to update the notes in
81-
this item.
18+
<Steps>
19+
<Step>
20+
### <StepNumber/> Create the SuperAdmin User
8221

83-
<img src="/assets/refarch/image-20211016-220615.png" /><br/>
22+
First, create the SuperAdmin IAM user in the AWS web console.
8423

85-
### Detailed Instructions
24+
<Steps>
25+
1. Login to the AWS `root` account using the root credentials.
8626

87-
These are just some more detailed step-by-step instructions. These are redundant with the basic instructions and might
88-
be out of date as the AWS web console interface changes.
27+
1. In the IAM console, select "Users" on the sidebar.
28+
<img src="/assets/refarch/image-20210720-181056.png" />
8929

90-
1. Login to the AWS `root` account using the root credentials from 1Password
30+
1. Click "Add users" button
31+
<img src="/assets/refarch/image-20210720-181130.png" />
32+
<img src="/assets/refarch/image-20210720-181200.png" />
9133

92-
2. Navigate to the IAM console page
93-
<img src="/assets/refarch/image-20210720-181056.png" /><br/>
34+
1. Enter "SuperAdmin" for "User name" and check "Programmatic access" and leave "AWS Management Console access" unchecked. Click "Next: Permissions"
35+
<img src="/assets/refarch/image-20210720-181251.png" />
9436

95-
3. In the IAM console, select `Users` on the sidebar
37+
1. Under "Set permissions", select "Attach existing policies directly". A list should appear, from which you should check "AdministratorAccess". Click "Next: Tags"
38+
<img src="/assets/refarch/image-20210720-181512.png" />
9639

97-
4. <img src="/assets/refarch/image-20210720-181130.png" /><br/>Click `Add users` button <img src="/assets/refarch/image-20210720-181200.png" /><br/>
40+
1. Skip the tags, Click "Next: Review"
9841

99-
5. Enter "SuperAdmin" for `User name` and check `Programmatic access` and leave `AWS Management Console access`
100-
unchecked. Click `Next: Permissions` at the bottom right corner of the page
42+
1. Review and click "Create user"
10143

102-
<img src="/assets/refarch/image-20210720-181251.png" /><br/>
44+
1. The Success page should show you the "Access key ID" and hidden "Secret access key" which can be revealed by clicking "Show". Copy these to your secure credentials storage as you will need them shortly
45+
<img src="/assets/refarch/image-20210720-181626.png" />
10346

104-
6. Under `Set permissions` , select `Attach existing policies directly` . A list should appear, from which you should
105-
check `AdministratorAccess` . Click `Next: Tags` at the bottom right corner of the page
47+
1. Click "Close" to return to the IAM console. Select "Users" on the sidebar if it is not already selected. You should see a list of users. Click the user name "SuperAdmin" (which should be a hyperlink) to take you to the Users -> SuperAdmin "Summary" page
48+
<img src="/assets/refarch/image-20210720-182019.png" />
10649

107-
<img src="/assets/refarch/image-20210720-181512.png" /><br/>
50+
1. On the "Users -> SuperAdmin" "Summary" page, click on the "Security credentials" tab
10851

109-
7. Skip the tags, Click `Next: Review` at the bottom right corner of the page
52+
1. In the "Sign-in credentials" section, find: "Assigned MFA device: Not assigned | Manage" and click "Manage"
53+
<img src="/assets/refarch/image-20210720-182257.png" />
11054

111-
8. Review and click `Create user` at the bottom right corner of the page
55+
1. Choose "Virtual MFA device" and click "Continue"
56+
<img src="/assets/refarch/image-20210720-182421.png" />
11257

113-
9. The Success page should show you the `Access key ID` and hidden `Secret access key` which can be revealed by clicking
114-
`Show` , copy these to your secure credentials storage as you will need them shortly
58+
1. Press the "Show secret key" button
59+
<img src="/assets/refarch/image-20210721-151123.png" />
11560

116-
<img src="/assets/refarch/image-20210720-181626.png" /><br/>
61+
1. Copy the key into 1Password as a AWS Credential using the "MFA" field
62+
<img src="/assets/refarch/image-20210721-151429.png" />
11763

118-
10. Click `Close` at the bottom right corner to return to the IAM console and select `Users` on the sidebar if it is not
119-
already selected
64+
1. Use the MFA codes from 1Password to complete the MFA setup process (you will input 2 consecutive codes)
65+
<img src="/assets/refarch/image-20210721-151622.png" />
12066

121-
11. You should a list of users. Click the user name `SuperAdmin` (which should be a hyperlink)
67+
1. You should be taken back to the "Security Credentials" tab, but now the "Assigned MFA device" field should have an ARN like `arn:aws:iam::<account-number>:mfa/SuperAdmin`
68+
<img src="/assets/refarch/image-20210720-182914.png" />
12269

123-
<img src="/assets/refarch/image-20210720-182019.png" /><br/>
70+
1. Copy the ARN and keep it with the Access Key in 1Password
12471

125-
12. On the `Users -> SuperAdmin` "Summary" page, click on the `Security credentials` tab
72+
1. Now we need to create an Access Key for CLI access. Click on the "Create Access Key" under "Access Keys"
12673

127-
13. In the `Sign-in credentials` section, find: `Assigned MFA device: Not assigned | Manage` and click `Manage`
74+
1. Select "Command Line Interface" and click the "I understand..." checkbox then click 'Next'
12875

129-
<img src="/assets/refarch/image-20210720-182257.png" /><br/>
76+
1. Enter a description if you like, such as 'SuperAdmin CLI Access' and click 'Create'
77+
</Steps>
78+
</Step>
13079

131-
14. Choose `Virtual MFA device` and click `Continue`
80+
<Step>
81+
### <StepNumber/> Store SuperAdmin Credentials in 1Password
13282

133-
<img src="/assets/refarch/image-20210720-182421.png" /><br/>
83+
The `SuperAdmin` credentials should be properly stored in 1Password. Relative to other potential 1Password item types, the most appropriate 1Password item type for these credentials is `login`. Since these are programmatic credentials and not an actual login with an endpoint from which the website favicon can be retrieved. Additionally, the password field should be kept empty. For convenience in retrieving the TOTP code when using Leapp, save `com.leapp.app` as a website URL.
13484

135-
15. Press the `Show secret key` button
85+
<Steps>
86+
1. Set the username to `SuperAdmin`
87+
1. Create fields for the `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and the TOTP (known as One Time Password field type in 1password) via the AWS virtual MFA device's secret
88+
1. Add a note in the following format:
13689

137-
<img src="/assets/refarch/image-20210721-151123.png" /><br/>
90+
```
91+
This account's Access Key should be made inactive when not needed.
13892
139-
16. Copy the key into 1Password as a AWS Credential using the “MFA” field
93+
CURRENT STATUS: ACTIVE
14094
141-
<img src="/assets/refarch/image-20210721-151429.png" /><br/>
95+
Use this account for API/command line access to administrative functions that IAM roles cannot do, such as provision IAM roles.
14296
143-
17. Use the MFA codes from 1Password to complete the MFA setup process (you will input 2 consecutive codes)
97+
This account should not be allowed to log in to the AWS console, and therefore does not have a password.
14498
145-
<img src="/assets/refarch/image-20210721-151622.png" /><br/>
99+
Root account ID: [AWS ACCOUNT ID]
146100
147-
18. You should be taken back to the `Security Credentials` tab, but now the `Assigned MFA device` field should have an
148-
ARN like `arn:aws:iam::<account-number>:mfa/SuperAdmin`
101+
User ARN arn:aws:iam::[AWS ACCOUNT ID]:user/SuperAdmin
149102
150-
<img src="/assets/refarch/image-20210720-182914.png" /><br/>
103+
MFA Device ARN arn:aws:iam::[AWS ACCOUNT ID]:mfa/SuperAdmin
104+
```
151105

152-
19. Copy the ARN and keep it with the Access Key in 1Password
106+
The resulting entry in 1password should appear as follows:
107+
<img src="/assets/refarch/image-20211016-220615.png" />
153108

154-
20. Configure AWS profile with the SuperAdmin user credentials:
109+
1. Hit save once you are done. Once the SuperAdmin credentials need to be disabled, do not forget to update the notes in this item
110+
</Steps>
111+
</Step>
112+
</Steps>
155113

156-
21. If it does not already exist on your host computer, create the file `$HOME/.aws/config`
114+
## References
157115

158-
22. Add the following lines to the end of the `$HOME/.aws/config` file:
159-
160-
````ini`
161-
162-
`[profile SuperAdmin]`
163-
164-
`region = us-west-2`
165-
166-
`default_region = us-west-2`
167-
168-
`mfa_serial = arn:aws:iam::<account-number>:mfa/SuperAdmin`
169-
170-
```
171-
172-
replacing `us-west-2` with the primary region where you will be hosting your company's infrastructure,
173-
174-
and `arn:aws:iam::<account-number>:mfa/SuperAdmin` with the "Assigned MFA device" ARN from the previous step.
175-
176-
21.
177-
178-
:::tip
179-
180-
Done!
181-
182-
:::
183-
184-
### Related articles
185-
186-
:::note
187-
188-
The content by label feature displays related articles automatically, based on labels you choose. To edit options for this feature, select the placeholder below and tap the pencil icon.
189-
190-
:::
191-
192-
| Related issues | |
193-
| -------------- | --- |
194-
195-
```
116+
[REFARCH-73 - Provision SuperAdmin User for Root Level IAM Management](/layers/accounts/prepare-aws-organization/#create-the-superadmin-iam-user)

0 commit comments

Comments
 (0)