I've been using #AWS for 8+ years now, so IAM is relatively second-nature to me. But I just sat down to explain it to someone new to AWS and... wow, it is a confusing service. (thread) #aws #cloud #security #cloudcomputing
First, we've got policies - what can the role do and what services can it access? Policies are JSON-based (although AWS added a "friendlier" UI recently, which honestly creates some really confusing output). Most common security mistake here: using wildcards.
An IAM user or role can then have multiple policies, each with 1+ statements. Policies can be inline, AWS-managed, or account-managed (i.e. shared). Policies can be attached directly to users or roles or to the groups those users are in.
On top of policies, there are now "permission boundaries" which represent the broadest scope an IAM entity can have. These are also JSON-based. So... the policy you attached may not fully represent the scope of what the entity can do because the boundary may restrict it.
Some services, like KMS, ECR or S3, have additional policies that can be attached to their resources (e.g. keys, buckets or image repositories) that further restrict which IAM entities can access it. These combine with IAM policies in a two-way trust of sorts.
Finally, there are trust relationships for IAM roles - what AWS services and entities can utilize the role? *However*, trust relationships only define what can invoke the initial credential generation mechanism, not what services can actually *use* those credentials.
This has led to some interesting security incidents where attackers trick the EC2 metadata service into generating credentials on the instance's behalf and then use those credentials from a local laptop.
IMO, this entire tangled mess of roles, policies, permissions, trust statements, etc. has really made it difficult for new developers to AWS to design secure systems.
If IAM keeps you up at night, or you just want a refresher, I am working on an eBook that (hopefully) simplifies things a bit. Drop your email here and I'll ping you when the book goes live: forms.gle/bAcohu1Evf5rWu…
