IAM Secure Are You

The subject of my talk was "IAM Secure, Are You?". I showed some nice "Did you knows". Like did you know that when AWS started in 2006, there was no IAM service and you needed to login with your amazon.com account. And that in 2010 IAM was only programmatically accessible (preview version). And that in 2011 console access was announced and you could login with IAM users into the console instead of your root account.

I explained the basics of IAM, but also things like:

- Identity-based policies vs. Resource-based policies
- Session policies
- Policy conditions
- Policy variables
- RBAC (role-based access control) vs. ABAC (attribute-based access control)

With ABAC you can do things like: if your role tag "job-title" does not equal to Product-Manager you are denied to the production S3 bucket.

I ended with a demo and some best practices. With the demo I explained the IAM decision tree. In the demo I created a IAM read-only identity-based policy and attached this policy to a demo role. I also created a SQS queue with a send-only resource-based policy for this role. I then sent a message onto the SQS queue as an admin user and assumed the demo role. With this demo role I tried polling the message. I asked the audience wether the polling (read) request would succeed while the role uses read permission, but the queue only has send permissions. The result was that the polling succeeded, which led to some confusion :-D, but I did this on purpose.

Transcript

1. IAM Secure, Are You? Enri Peters Schuberg Philis
2. Who Principal Can access Action What Resource When Condition
9. 4271 days ago Sep 2, 2010 Preview Beta
10. 4028 days ago May 3, 2011 Console access
11. Who Aka the Principal
15. Can access Aka the Action
16. What Aka Resource
17. Read, Write, Full Control Access Control Lists (ACLs) 53.34.19.23
18. AWSCloudTrailReadOnlyAcces AWSCloudTrailReadOnlyAcces AWSCloudTrailReadOnlyAcces AWS Managed Identity-based policy
19. MyOwnFancyStrictPolicy MyOwnFancyStrictPolicy MyOwnFancyStrictPolicy Customer Managed Identity-based policy
20. Inline policy Identity-based policy
21. Permission boundaries
22. Session policies
23. Service control policies (SCPs)
24. Resource-based policy
25. When Aka the Condition
26. Numeric condition Date condition String condition
27. ...IfExists condition Boolean condition IP address condition
29. Variables
30. Tags (ABAC)
40. 893 days ago Dec 2, 2019 Access Analyzer
41. The end