115. What can you do with Permissions Boundaries?
AWS Bites
In this episode, we discuss Permission Boundary policies in AWS IAM. A permissions boundary is an advanced feature in which you set the maximum permissions that an identity-based policy can grant to an IAM entity. When you set a permissions boundary for an entity, the entity can perform only the actions allowed by its identity-based policies and its permissions boundaries. In this episode, we discuss this concept a bit more in detail and we show how it can be used to give freedom to development teams while preventing privilege escalation. We also cover some of the disadvantages that come with using permission boundaries and other things to be aware of. Finally, we will give some practical advice on how to get the best out of Permissions Boundary Policy and get the best out of them.
💰 SPONSORS 💰
AWS Bites is brought to you by fourTheorem, the AWS consulting partner with lots of experience with AWS, Serverless, and Lambda. If you are looking for a partner that can help you deliver your next Serverless workload successfully, look no further and reach out to us at https://fourtheorem.com
🔖 Chapters:
00:00 Intro 01:02 What are permissions boundaries in AWS? 01:49 Explanation of "shifting security left" and how it relates to permissions boundaries 03:23 How to prevent privilege escalation using permissions boundaries 05:05 How permission boundaries prevent privilege escalation 07:30 Disadvantages and potential issues with permission boundaries 09:45 Who the heck are Bob and Alice, btw? 10:51 Summary of key points about permission boundaries
In this episode, we mentioned the following resources:
- Episode 112. "What is a Service Control Policy (SCP)?": https://awsbites.com/112-what-is-a-service-control-policy-scp/
- IAM Policy Simulator: https://policysim.aws.amazon.com/home/index.jsp?#roles
- The famous RSA paper that introduces Alice and Bob in the world of cryptography: https://web.williams.edu/Mathematics/lg5/302/RSA.pdf
- A biographical backstory on Alice and Bob: https://urbigenous.net/library/alicebob.html
You can listen to AWS Bites wherever you get your podcasts:
- Apple Podcasts: https://podcasts.apple.com/us/podcast/aws-bites/id1585489017
- Spotify: https://open.spotify.com/show/3Lh7PzqBFV6yt5WsTAmO5q
- Google: https://podcasts.google.com/feed/aHR0cHM6Ly9hbmNob3IuZm0vcy82YTMzMTJhMC9wb2RjYXN0L3Jzcw==
- Breaker: https://www.breaker.audio/aws-bites
- RSS: ​​https://anchor.fm/s/6a3312a0/podcast/rss
Do you have any AWS questions you would like us to address? Leave a comment here or connect with us on X, formerly Twitter:
#aws #permissions #iam #policy ... https://www.youtube.com/watch?v=wqrjjdJBiDo
108555425 Bytes