Using IAM Roles Anywhere for free

IAM Roles Anywhere is a great way to get temporary security credentials on on-premises, or mulit-cloud or edge devices. However the complexity of managing your own PKI or the cost of using an AWS Private CA might have stopped you from seriously considering it. In this session we will look at how IAM Roles anywhere works and why that means we can use low-cost solutions like a yubikey for authentication. Just for fun we’ll even use a Belgian Identity Card to access our AWS Account.

Delivered at AWS Community Day Utrecht 2025

Transcript

1. Using IAM Roles Anywhere for free Ben Bridts
2. https://reinforce.awsevents.com/content/dam/reinforce/2024/slides/TDR432_New-tactics-and-techniques-for-proactive-threat-detection.pdf
9. IAM Roles Anywhere Moving the problem around
10. IAM Roles Anywhere Server IAM Roles Anywhere Certificate + Signature 1
11. IAM Roles Anywhere Server IAM Roles Anywhere Trust Anchor Certificate + Signature 1 2
12. IAM Roles Anywhere Server IAM Roles Anywhere AWS STS Trust Anchor Certificate + Signature Role 1 2 3
13. IAM Roles Anywhere Server IAM Roles Anywhere AWS STS Temporary security credential Trust Anchor Certificate + Signature Role 1 2 3 4
14. AWS Private CA
15. Design a CA hierarchy https://aws.amazon.com/private-ca/pricing/ https://docs.aws.amazon.com/privateca/latest/userguide/ca-hierarchy.html
16. Belgian Government CA Moving the other problem
17. https://repository.eidpki.belgium.be/#/home https://www.ibz.rrn.fgov.be/nl/burger/identiteitsdocumenten/eid
18. https://repository.eidpki.belgium.be/#/home https://www.ibz.rrn.fgov.be/nl/burger/identiteitsdocumenten/eid
19. https://repository.eidpki.belgium.be/#/home https://www.ibz.rrn.fgov.be/nl/burger/identiteitsdocumenten/eid not my problem
20. Server IAM Roles Anywhere AWS STS Temporary security credential Trust Anchor Certificate + Signature Role 1 2 3 4
21. IAM Roles Anywhere AWS STS Trust Anchor Role 2 3
22. IAM Roles Anywhere AWS STS Trust Anchor Role 2 3
23. IAM Roles Anywhere AWS STS Trust Anchor Role 2 3
24. IAM Roles Anywhere AWS STS Trust Anchor Role 2 3
25. AWS IAM Roles Anywhere Credential Helper These go to pkcs11
26. Server IAM Roles Anywhere Temporary security credential Certificate + Signature 1 4
27. Demo No problem?
28. Some problems • Finding the right pkcs11 library on MacOS • Limited information in the certificate • PIN code • Caching or serve command
29. Actual Useful ways to use IAMRA Getting "free" CAs • Exiting PKI • Hardware keys with attestation • Let's encrypt Getting better key storage • Trusted Platform Modules • Hardware keys
30. Further reading • https://aws.amazon.com/blogs/security/planning-for-your-iam-roles- anywhere-deployment/ • https://aws.amazon.com/blogs/security/connect-your-on-premises- kubernetes-cluster-to-aws-apis-using-iam-roles-anywhere/ • https://cloudar.be/awsblog/sign-in-with-your-eid-using-aws-iam- roles-anywhere-with-a-smartcard-reader/ • https://github.com/aws/rolesanywhere-credential-helper • https://github.com/WeAreCloudar/cloudformation- samples/tree/main/templates/roles-anywhere-eid
31. Thank you! ben@cloudar.be benbridts @benbridts