Top-Level Admin

Requirement

Component Implementation (OSCAL)

Executive Summary

AWS Administrative Account Types and Naming Conventions

Account Type Hierarchy

• Purpose: Central control point for AWS Organizations
• Naming Convention: [org-name]-management-[environment] (e.g., acme-management-prod)
• Account ID Reference: 12-digit unique identifier (e.g., 123456789012)
• Administrative Scope: Full organizational control, billing consolidation, service control policies

• Purpose: Centralized security logging and compliance monitoring
• Naming Convention: [org-name]-security-[function] (e.g., acme-security-audit)
• Administrative Scope: CloudTrail log aggregation, AWS Config compliance, Security Hub findings

• Purpose: Common infrastructure services (DNS, Active Directory, monitoring)
• Naming Convention: [org-name]-shared-[service] (e.g., acme-shared-network)
• Administrative Scope: Cross-account resource sharing, centralized services

• Purpose: Application and service hosting
• Naming Convention: [org-name]-[workload]-[environment] (e.g., acme-webapp-prod)
• Administrative Scope: Application-specific resources and permissions

Administrative Role Naming Standards

• OrganizationAccountAccessRole: Default cross-account access role created by AWS Organizations
• AWSControlTowerExecution: AWS Control Tower service role for governance
• AWSServiceRoleFor[ServiceName]: Service-linked roles for AWS services

• Naming Pattern: [Function]-[Scope]-[Environment]Role
• Examples:

Account Reference Methods

• Account Switcher: Displays account name and ID
• Organization view: Shows account hierarchy and organizational units
• Billing console: Lists all accounts with names and IDs

• AWS CLI: Use account ID or account alias for cross-account operations
• AWS APIs: Reference accounts by 12-digit account ID
• CloudFormation: Use account ID in cross-account resource references

AWS Root Account Security Architecture

AWS Organizations Root Access Management (Recommended)

• Remove Long-term Root Credentials: Programmatically eliminate root user passwords, access keys, and signing certificates from member accounts
• Prevent Credential Recovery: Block unauthorized recovery of root credentials, supporting secure credential management
• Secure-by-Default Provisioning: Create new AWS accounts without root credentials from inception, supporting streamlined security configuration
• Compliance Visibility: Centralized discovery and monitoring of root credential status across all organization accounts

• Auditing Root User Credentials: Read-only access to review root user information and security posture
• Re-enabling Account Recovery: Restore account recovery capabilities without requiring long-term root credentials
• Deleting Root User Credentials: Remove console passwords, access keys, signing certificates, and MFA devices
• Unlocking S3 Bucket Policies: Edit or delete S3 bucket policies that deny all principals (emergency access)
• Unlocking SQS Queue Policies: Edit or delete Amazon SQS resource policies that deny all principals

Implementation Commands

• You must be signed in as the management account root user or have appropriate IAM permissions
• Your AWS Organization must already be created
• You need the organizations:EnableAWSServiceAccess permission

aws organizations enable-aws-service-access --service-principal sso.amazonaws.com

# Enable AWS Config service access
aws organizations enable-aws-service-access --service-principal config.amazonaws.com

# Enable AWS CloudTrail service access
aws organizations enable-aws-service-access --service-principal cloudtrail.amazonaws.com

aws organizations enable-aws-service-access --service-principal iam.amazonaws.com

# Note: Root access management is configured through the AWS Organizations console
# Navigate to AWS Organizations > Settings > Root access management
# This cannot be enabled via CLI at this time

# Note: Root sessions are configured through the AWS Organizations console
# Navigate to AWS Organizations > Settings > Root access management
# This cannot be enabled via CLI at this time

# Note: Root sessions must be initiated through the AWS Organizations console
# Navigate to AWS Organizations > Accounts > Select account > Root access
# CLI access for root sessions is not currently available

Traditional Root Account Security (Legacy Approach)

AWS Organizations Management Account

AWS IAM Identity Center (Successor to AWS SSO)

AWS Control Tower Landing Zone

Service-Level Administrative Accounts

# Create RDS instance with IAM authentication
aws rds create-db-instance \
    --db-instance-identifier mydb-instance \
    --db-instance-class db.t3.micro \
    --engine mysql \
    --master-username admin \
    --manage-master-user-password \
    --master-user-secret-kms-key-id alias/aws/rds \
    --enable-iam-database-authentication \
    --storage-encrypted \
    --kms-key-id alias/aws/rds

Container Administrative Access

• Cluster Authentication: Use IAM roles for service accounts (IRSA)
• RBAC Configuration: Implement Kubernetes role-based access control
• Pod Security: Enable Pod Security Standards and admission controllers
• Network Policies: Implement Kubernetes network policies for micro-segmentation
• Audit Logging: Enable EKS control plane logging to CloudWatch

Administrative Account Configuration Management

Configuration Baselines

# Deploy organization-wide Config rule for root account MFA
aws configservice put-organization-config-rule \
    --organization-config-rule-name "org-root-mfa-enabled" \
    --organization-managed-rule-metadata \
        RuleIdentifier=ROOT_MFA_ENABLED,Description="Checks whether MFA is enabled for root account"

# Create SCP to prevent root account usage
aws organizations create-policy \
    --name "PreventRootAccountUsage" \
    --description "Deny root account actions except emergency scenarios" \
    --type SERVICE_CONTROL_POLICY \
    --content '{
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Deny",
                "Principal": {
                    "AWS": "*"
                },
                "Action": "*",
                "Resource": "*",
                "Condition": {
                    "StringEquals": {
                        "aws:PrincipalType": "Root"
                    },
                    "StringNotEquals": {
                        "aws:RequestedRegion": ["us-east-1", "us-west-2"]
                    }
                }
            }
        ]
    }'

Configuration Drift Detection

# Get compliance status for administrative accounts
aws configservice get-compliance-details-by-config-rule \
    --config-rule-name "root-mfa-enabled" \
    --compliance-types NON_COMPLIANT

# Create compliance association for administrative instances
aws ssm create-association \
    --name "AWS-GatherSoftwareInventory" \
    --targets "Key=tag:AccountType,Values=Administrative"

Daily Operations and Maintenance

Routine Administrative Tasks

• Review CloudTrail logs for root account activity
• Verify MFA status for all administrative users
• Check AWS Config compliance dashboard
• Monitor Security Hub findings for important security issues

• Audit IAM user and role permissions
• Review AWS Trusted Advisor security recommendations
• Validate backup and recovery procedures
• Update security group and NACL rules as needed

• Generate compliance reports for FedRAMP assessments
• Review and update administrative procedures
• Conduct access reviews for administrative accounts
• Test incident response procedures

Administrative Task Commands

# List all administrative users and their last activity
aws iam generate-credential-report
aws iam get-credential-report --query 'Content' --output text | base64 -d > credential-report.csv

# Query CloudTrail for root account usage in last 30 days
aws logs filter-log-events \
    --log-group-name "CloudTrail/RootAccountActivity" \
    --start-time $(date -d '30 days ago' +%s)000 \
    --filter-pattern '{ $.userIdentity.type = "Root" }'

Account Decommissioning Procedures

Pre-Decommissioning Requirements

• Export all CloudTrail logs to long-term storage
• Backup AWS Config configuration history
• Archive Security Hub findings and compliance reports
• Export billing and usage reports for audit purposes

# List all resources in account before decommissioning
aws resourcegroupstaggingapi get-resources \
    --resources-per-page 100 \
    --output table

• Identify cross-account resource dependencies
• Document shared services and integrations
• Review IAM cross-account trust relationships
• Catalog DNS and network dependencies

Decommissioning Steps

# Remove account from organization (if member account)
aws organizations remove-account-from-organization \
    --account-id 123456789012

# Note: Account closure must be done through the AWS Console
# 1. Sign in as root user to the account being closed
# 2. Navigate to Account Settings in the AWS Console
# 3. Scroll to "Close Account" section
# 4. Follow the account closure process
# CLI account closure is not available

• Remove account from organizational charts
• Update network diagrams and architecture documentation
• Archive administrative procedures and runbooks
• Update compliance documentation and evidence

Post-Decommissioning Validation

# Verify account is no longer accessible
aws organizations list-accounts \
    --query 'Accounts[?Id==`123456789012`]'

• Maintain decommissioning records for audit purposes
• Archive final compliance reports and assessments
• Document lessons learned and process improvements
• Update incident response procedures if needed

Monitoring and Compliance

CloudTrail Configuration

# Create CloudTrail for root account monitoring
aws cloudtrail create-trail \
    --name root-account-trail \
    --s3-bucket-name security-audit-logs \
    --include-global-service-events \
    --is-multi-region-trail \
    --enable-log-file-validation \
    --event-selectors '[{
        "ReadWriteType": "All",
        "IncludeManagementEvents": true,
        "DataResources": []
    }]'

Real-time Alerting

# Create metric filter for root account usage
aws logs put-metric-filter \
    --log-group-name CloudTrail/RootAccountActivity \
    --filter-name RootAccountUsage \
    --filter-pattern '{ $.userIdentity.type = "Root" }' \
    --metric-transformations \
        metricName=RootAccountUsageCount,metricNamespace=Security/RootAccount,metricValue=1

Emergency Procedures

Root Account Compromise Response

• Review CloudTrail logs for unusual activities
• Check AWS Config for configuration changes
• Analyze VPC Flow Logs for network anomalies
• Review IAM policy changes and user creations

• Consider implementing AWS Organizations root access management
• Remove long-term root credentials where possible
• Update incident response procedures based on lessons learned
• Conduct security assessment and review

Emergency Access Procedures

# Assume emergency access role (pre-configured)
aws sts assume-role \
    --role-arn "arn:aws:iam:ACCOUNT-ID:role/EmergencyAccessRole" \
    --role-session-name "emergency-$(date +%Y%m%d-%H%M%S)"

# Note: Emergency root access must be requested through AWS Organizations console
# 1. Navigate to AWS Organizations > Accounts
# 2. Select the target account
# 3. Choose "Root access" 
# 4. Select appropriate task policy and provide justification
# 5. Complete the root session request process
# CLI-based root session requests are not currently available

Access Control Matrix and Approval Workflows

Role-Based Access Permissions

Approval Workflow Requirements

• Single approver from appropriate team lead
• Change request documentation required
• Automated testing in non-production first

• Dual approval required (requestor + approver)
• Business justification documented
• Time-limited access (maximum 4 hours)

• Incident commander approval
• Real-time notification to security team
• Post-incident review within 24 hours recommended

FedRAMP Continuous Monitoring Requirements

Evidence Collection and Reporting

# Generate AWS Config compliance summary
aws configservice get-compliance-summary-by-config-rule \
    --output table > monthly-config-compliance.txt

# Export Security Hub findings
aws securityhub get-findings \
    --filters '{"ComplianceStatus":[{"Value":"FAILED","Comparison":"EQUALS"}]}' \
    --output json > monthly-security-findings.json

# Create EventBridge rule for real-time compliance monitoring
aws events put-rule \
    --name "FedRAMP-ComplianceMonitoring" \
    --event-pattern '{
        "source": ["aws.config"],
        "detail-type": ["Config Rules Compliance Change"],
        "detail": {
            "newEvaluationResult": {
                "complianceType": ["NON_COMPLIANT"]
            }
        }
    }'

Audit Trail Requirements

# Set CloudTrail log retention to 7 years for FedRAMP
aws logs put-retention-policy \
    --log-group-name "CloudTrail/FedRAMP-AuditLogs" \
    --retention-in-days 2557  # 7 years

# Create organization-wide CloudTrail
aws cloudtrail create-trail \
    --name "FedRAMP-OrganizationTrail" \
    --s3-bucket-name "fedramp-audit-logs-bucket" \
    --is-organization-trail \
    --enable-log-file-validation \
    --include-global-service-events

Compliance Validation

AWS Config Rules for Root Account Security

# Deploy Config rule for root account MFA
aws configservice put-config-rule \
    --config-rule '{
        "ConfigRuleName": "root-mfa-enabled",
        "Source": {
            "Owner": "AWS",
            "SourceIdentifier": "ROOT_MFA_ENABLED"
        }
    }'

# Deploy Config rule for root account access key check
aws configservice put-config-rule \
    --config-rule '{
        "ConfigRuleName": "root-access-key-check",
        "Source": {
            "Owner": "AWS",
            "SourceIdentifier": "ROOT_ACCESS_KEY_CHECK"
        }
    }'

Best Practices Summary

• Consider implementing AWS Organizations root access management for centralized, secure root account control
• Eliminate long-term root credentials in favor of temporary, task-scoped access
• Use standardized naming conventions for accounts and administrative roles
• Maintain clear documentation of account hierarchy and administrative responsibilities

• Enable comprehensive logging and monitoring for all administrative account activities
• Implement least privilege access through IAM roles and policies with time-limited sessions
• Use AWS managed services for credential management and rotation
• Consider establishing automated compliance monitoring and real-time alerting for policy violations

• Regularly audit and review administrative account usage and permissions
• Maintain incident response procedures for account security scenarios
• Implement proper change management processes for administrative account modifications
• Conduct regular testing of emergency access procedures and account recovery processes

• Maintain audit trails with appropriate retention periods (7 years minimum recommended)
• Generate regular compliance reports and evidence collection as required by your organization
• Consider implementing continuous monitoring for security and compliance posture
• Document all administrative procedures and maintain version control