Dual - control (two man access) to AWS root logins?

Question

I've been going around a few threads / questions here but none of them actually talked about concrete implementation of two-man authorization methods. I've read reasonable amount of ideas and "why"s but I am now looking for best ways to implement them.

To give you some context: A and B works in the devOps / sytem admin team that manages the infrastructure for some company. They both decide that its a good idea to have two-man authentication where they both would have to perform some kind of authorization task in order to get / grant access.

I've read about several ways of doing this, for example: 1. Both admins have a part of the password which would work only when they key it in. 2. Token generation which would not reveal the actual secrets and would be destroyed after X hours of usage.

I want to implement this in case either one of us goes crazy and decides to wipe the systems. Any suggestions are appreciated. The use case would mostly be for AWS.

Thanks!

Answer 1

Although i have not heard of such a system, i may have an alternative solution for you.

Use 2FA, have the account password with PersonA, and the push notification going to PersonB to authorize the login.

Eg. You could use DUO 2FA, PersonA will input the password to the AWS bucket, and DUO will send a push notification to PersonB, if the login should proceed or not.

This is almost as both admins having part of the password, only that 1 part is a password, and the second is a push notification for further authentication.

I can say from almost an year of using this model in a non-critical environment, it has worked well. But would not have it as our ultimate solution.

Cheers