AWS IAM User Created

Monitoring IAM user creation in real-time is absolutely necessary for keeping your AWS cloud account safe. Because IAM users can be created with overly permissive policies such as those with administrator-level permissions (where the user has authorization to modify or remove any resource, access any data within your cloud environment, and use any AWS service or component), using IAM user identities by inexperienced or unauthorized personnel within your organization can introduce severe security issues which can lead to data leaks, data loss, or even unexpected charges on your AWS bill. Unfortunately, as an organization grows and more people get involved in the operational aspect of the AWS cloud administration, the tendency is to create more than one privileged IAM user and this poses a huge operational and security risk. To adhere to cloud security best practices and implement the Principle of Least Privilege (also known as the principle of least authority, i.e. the security concept of providing every user, process, or system the minimal set of permissions required to perform successfully its tasks), Trend Micro Cloud One™ – Conformity strongly recommends monitoring the creation of IAM users and ultimately avoid creating more than one privileged IAM user, unless it is really necessary. Ideally, the IAM administration and permission management within your AWS account should be divided between two well-defined roles: IAM Master and IAM Manager. These custom roles should be utilized by designated personnel only to create and configure other IAM users and roles with limited permissions that follow the same principle of least privilege. Since each IAM user creation event is being detected by the Real-Time Threat Monitoring and Analysis (RTMA) feature, the AWS account administrator has the chance to prevent any potential security issues that could be introduced by new, over-privileged IAM users. Using Trend Micro Cloud One™ – Conformity RTMA detection for Amazon IAM user creation will help you enforce stricter and safer access policies within your organization.