Skip to main content


Showing posts from 2019

IAM Policies in a nutshell

A Policy is 'Deny' by default

Types of Policies:
1. SCP- SCP or Service control polcies. AWS Organizations use this kind of policies.For example, Guardrails to disable service access on the principals in the account.

2. IAM- Permission Policies and Permission Boundaries- Granular permissions on IAM principles (users and roles) and control maximum permissions they can set.

3. AWS STS- Security Token Service- Reduce general shared permissions further

4. Resource based policies: Cross-account access and to control from the resource

5. Endpoint polices- generally attached with VPCs- Control access to the service with a VPC endpoint.

How all these policies work together- within an account:

SCP AND [IAM policies OR Resource based policies]- If both policies match- then the matched action will be allowed, otherwise denied.

How all these policies work together- across accounts:

SCP AND [IAM policies AND Resource based policies]- All the 3 must have the same actions matched- the action will be …

Exploiting meta-data on AWS

Metadata server: Every EC2 instance has some user scripts which can be used to pull configuration to launch that EC2 instance. Those configs are stored on a Metadata server ( 'private' to that Ec2 instance. Each time an Ec2 instance starts , AWS attached the " meta data server" to it, which can be accessed from the instance itself using The instance meta-data stores information such as :AMIid, Private IP address, Instance Type etc...and...

User-data: OS boot scripts:
AWS allows you to boot up the EC2 using a custom User-data scripts- such as web application, Apache web server, keys. credentials etc. This script, also called user data, is stored by AWS in the instance metadata and retrieved by the OS during boot.

Instance profile:
When EC2 instance wants to access other services such as S3, it uses credentials to access it. Instance profiles give Ec2 instances a way to access AWS services. AWS creates a unique set of…

AWS IAM in a nutshell

IAM users: Used for Human users, such as long term security credentials

IAM roles: Used for applications, automated services, they are short term security credentials. For example, a Lambda function wants to access EC2 instance.

IAM principal: An identity defines within an AWS account

Policies: Policies are permissions- they can be attached to Users, Groups or Roles. AWS authorizes every API call against the IAM policies that apply.

Breaking down IAM Policy (JSON files):

'Effect' clause: Describes if an action is allowed or not by setting 'Allow' or 'Deny'

'Action' clause: What all actions on a particular resource can be performed. A wild card (*) indicates all actions, which is very insecure permissions

'Resource' clause: Exact resource ARN.

Policies attached to Resources (more granular level IAM policies):

Generally IAM polcicies apply to Principal, but in some scenarios, the policies can be attached to individual resources too, such who can access th…