SEC06-BP03: Reduce manual management and interactive access
Reduce the risk of human error and the potential for configuration drift by replacing manual processes with automated processes where possible. Reduce interactive access to compute resources, for example, by using change management workflows to manage EC2 instances, and by using tools such as Amazon EC2 Systems Manager Session Manager instead of allowing direct access or bastion hosts.
Implementation guidance
Reducing manual management and interactive access is crucial for maintaining a secure and consistent compute environment. By minimizing human interaction with production systems, you can significantly reduce the risk of security incidents, configuration errors, and unauthorized access while improving operational efficiency and compliance.
Key steps for implementing this best practice:
- Implement Infrastructure as Code (IaC):
- Use AWS CloudFormation or AWS CDK for infrastructure provisioning
- Version control all infrastructure definitions
- Implement automated testing for infrastructure changes
- Establish code review processes for infrastructure modifications
- Use immutable infrastructure patterns where possible
- Automate configuration management:
- Use AWS Systems Manager for configuration management
- Implement configuration drift detection and remediation
- Automate software installation and updates
- Use desired state configuration tools
- Establish configuration baselines and compliance monitoring
- Replace interactive access with secure alternatives:
- Use AWS Systems Manager Session Manager for secure shell access
- Implement break-glass procedures for emergency access
- Use AWS Systems Manager Run Command for remote execution
- Eliminate SSH key management where possible
- Implement just-in-time access for administrative tasks
- Implement automated deployment pipelines:
- Use CI/CD pipelines for application deployments
- Implement blue-green or canary deployment strategies
- Automate rollback procedures for failed deployments
- Use container orchestration for application management
- Implement automated testing and validation in pipelines
- Establish monitoring and alerting for manual access:
- Monitor and log all interactive access attempts
- Set up alerts for unauthorized or unusual access patterns
- Implement session recording for audit purposes
- Track and report on manual interventions
- Establish metrics for automation coverage
- Implement change management workflows:
- Use ticketing systems for change requests
- Implement approval workflows for infrastructure changes
- Establish emergency change procedures
- Document all changes and their business justification
- Implement automated change validation and testing
Implementation examples
Example 1: AWS Systems Manager Session Manager configuration
Example 2: Automated configuration management with Systems Manager
Example 3: CI/CD pipeline for infrastructure automation
Example 4: Immutable infrastructure with container orchestration
AWS services to consider
Benefits of reducing manual management and interactive access
- Reduced human error: Automation eliminates mistakes that can occur during manual operations and configuration changes
- Improved security posture: Limiting interactive access reduces the attack surface and potential for unauthorized access
- Enhanced auditability: Automated processes provide better audit trails and compliance evidence than manual operations
- Increased consistency: Automated processes ensure consistent application of configurations and security policies
- Better scalability: Automated management scales more effectively than manual processes as infrastructure grows
- Faster incident response: Automated remediation can respond to issues faster than manual intervention
- Cost efficiency: Reduced manual effort translates to lower operational costs and improved resource utilization