A quick primer on IAM
Until now, we’ve been acting as though creating anomaly detection monitors, running queries on the CUR, and even creating an entire organization is as simple as logging into the management account and doing as you please. Fortunately (or unfortunately?), it’s not as simple as we’d like it to be. In fact, even logging into the management account shouldn’t be as easy as logging into your preferred social media platform.
First, you have to prove who you are. We’re all familiar with the process of authentication by providing a username and password. There’s no shortage of web applications that follow this commonly accepted practice – it’s not much different on AWS. You can associate usernames and passwords to AWS accounts, allowing principals to authenticate their identity using what they know (i.e., a password). You can (and should) enforce an additional layer of authentication using what they have, namely...