> For the complete documentation index, see [llms.txt](https://awsinpractice.itassist.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://awsinpractice.itassist.com/study-group/aws-certified-solutions-architect-associate/domain-1-design-secure-architectures/copy-of-task-statement-1.1-design-secure-access-to-aws-resources/securecarts-journey.md).

# SecureCart's Journey

## **Step 1: Define Access Requirements**

### **Identify User & Service Access Needs**

* **Who needs access?**
  * **Developers** → Need access to deploy and troubleshoot services.
  * **Security Team** → Requires full visibility but limited write permissions.
  * **Application Services** → Require controlled access to AWS resources (S3, RDS, etc.).
  * **Third-Party Vendors** → Need temporary, scoped access.
* **What AWS resources need access control?**
  * **Compute** (ECS, Lambda, EC2)
  * **Storage** (S3, EBS)
  * **Databases** (RDS, DynamoDB)
  * **IAM & Security Controls** (CloudTrail, GuardDuty, Config)
* **Multi-Account Structure in AWS Organizations**
  * **Management Account** → Governance & Security Controls.
  * **Workload Accounts** → Separate accounts for Dev, Staging, Production.
  * **Security & Logging Account** → Centralized logging, IAM monitoring, and threat detection.

***

## **Step 2: Establish Identity and Access Management (IAM) Best Practices**

### **Centralizing Identity with AWS Identity Center (SSO)**

* **AWS Identity Center (formerly SSO)** for **centralized user management**.
* **Federated access via Azure AD/Okta** using **SAML 2.0 or OIDC**.
* **Role-Based Access Control (RBAC) using IAM roles** mapped to Identity Center permissions.
* **Enforce MFA** for all users with Identity Center policies.

###  **Implementing IAM Role-Based Access**

* **No IAM users** → Use **IAM roles** with temporary credentials.
* **Principle of Least Privilege (PoLP)** → Define **custom IAM policies** with only required permissions.
* **IAM permission boundaries** to restrict max permissions developers can grant themselves.
* **IAM Access Analyzer** to monitor unintended public access.

***

## **Step 3: Enforcing Governance with AWS Organizations & SCPs**

### **Structuring AWS Organizations for Security & Governance**

* **Organizational Units (OUs)** for different environments:
  * `SecurityOU`: Security & compliance enforcement.
  * `WorkloadsOU`: Dev, Staging, Production workload accounts.
  * `SharedServicesOU`: Centralized CI/CD, logging, networking.

### **Applying Service Control Policies (SCPs)**

* **Prevent root user access** with an SCP.
* **Restrict usage of specific services** (e.g., disallow Internet Gateway creation outside networking accounts).
* **Enforce encryption for S3, RDS, and EBS** with SCPs.
* **Restrict AWS Region usage** to comply with data residency laws.

**Example SCP: Block Non-Compliant S3 Buckets**

```json
jsonCopyEdit{
    "Effect": "Deny",
    "Action": "s3:PutBucketPolicy",
    "Resource": "*",
    "Condition": {
        "StringNotEquals": {
            "s3:x-amz-server-side-encryption": "AES256"
        }
    }
}
```

***

## **Step 4: Implement Secure Multi-Account Access with STS & Federated Roles**

### **Using AWS Security Token Service (STS) for Temporary Access**

* **IAM Roles with STS assume-role** instead of IAM users.
* **Short-lived, auto-expiring credentials** instead of static API keys.
* **Cross-account role assumption** for accessing shared services.

### **Configuring Cross-Account Access for SecureCart Teams**

* **Developers assume `DeveloperRole` in Staging & Dev accounts**.
* **Security Engineers assume `SecurityAuditRole` across all accounts**.
* **CI/CD pipelines assume a `DeploymentRole` with minimal permissions**.

**📌 Example IAM Role Trust Policy for Cross-Account Access**

```json
jsonCopyEdit{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::111122223333:root"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}
```

*(Allows the account `111122223333` to assume the IAM role for cross-account access.)*