Working with Access Policies

After creating the users and groups who can access the services in your accounts, the next step in the process is to craft the policies that provide only the access necessary for each user, group, and role to perform their tasks. In the previous chapter, you reviewed how you could quickly provide access using a pre-crafted policy that AWS manages.

As an AWS security professional, it is most likely that one of your duties will be to write and tune the policies that grant and restrict access to the resources held in the account and AWS Organizations. You need to have a comprehensive understanding of how to provide both access and denial to services for the users, groups, and roles in your account.

You should also be familiar with the tools that can show you whether you have provided the policies that your entities need or a set of permissions that is too large or too narrow for the duties that they are trying to perform. You will learn about the tool...

Technical Requirements

To complete all the steps detailed in this chapter, you must have access to two separate AWS accounts and administrative access to the IAM service. You will also need access to a code or text editor, such as Visual Studio Code or Notepad++, to compose and edit the policy files.

Understanding the Differences between Access Policy Types

Policies are associated with users, groups, roles, or resources and define who or what can or cannot access AWS resources. You may already be familiar with some policy types, but AWS supports several different types of policies, including the following:

• Identity-based policies
• Resource-based policies
• Access control lists (ACLs)
• Simple Storage Service (S3) bucket policies
• Organization service control policies (SCPs)

The following sections discuss each type of policy in greater detail.

Identity-Based Policies

If you have been using AWS for any length of time, then you will be most familiar with this type of policy. Identity-based IAM policies in AWS are a way to manage permissions and control access for individual users, groups, or roles within your AWS accounts. You can attach these policies to identities created within the IAM service. These policies then define what actions those identities...

Identifying Policy Structure and Syntax

An AWS IAM policy consists of several parts that define the permissions and access control rules for AWS resources. The different components of an IAM policy are as follows:

• Version: The Version field specifies the version of the IAM policy language being used. The current version is typically set to 2012-10-17.
• ID: The ID field provides a unique identifier for the policy. It is optional and is mainly used for reference or management purposes.
• Statement: The Statement field is an array that contains one or more policy statements. Each statement defines a specific permission or access control rule. Multiple statements can be used to define different permissions within the same policy.
• Sid: The Sid field is an optional identifier for a statement. It is commonly used for reference and auditing purposes.
• Effect: The Effect field specifies whether the statement allows or denies access. There are only two options: Allow or Deny...

Key Conditional Terms to Know

To ensure you’re fully aware of all the tools at your disposal before you attempt to craft more complex policies, there are some conditional terms and operators you should be familiar with.

Note

The list of key terms provided is not all-inclusive. You also need not memorize each and every term from the list for the certification test.

The purpose of this section is to show you the different ways to narrow the scope of permissions within AWS accounts and organizations and help you become familiar with the operators and condition operators. Remember that these policies (as of the time of publication) are written in JSON.

Condition operators are broken down into the following categories:

• String
• Numeric
• Date and time
• Boolean
• Binary
• IP address
• ARN
• IfExists (check whether the key value exists and needs an additional value)
• NullCheck (check whether the key value exists and does not need another value...

Managing your IAM policies

Over time, you are likely to accumulate and use a long list of policies, especially as you create your own custom identity-based policies with highly specific permission sets of a user, group, or role. Therefore, it’s important to have an understanding of some of the features available to you within the IAM service and console that help you manage the roles that you create in your AWS accounts.

When you access a policy within the AWS Management Console—for example, a custom policy that you have created—you will be presented with a page that looks like the following:

Figure 14.10: The Policy details screen

The page will display the policy ARN and the description of the policy that you added when you created the policy. Underneath the Policy details section, you will have the following tabs:

• Permissions
• Entities attached
• Tags
• Policy versions
• Access Advisor

Each of these tabs...

Configuring Cross-Account Access Using IAM Policies

Cross-account access in AWS provides a way for you to securely collaborate and share resources with other AWS accounts. By configuring cross-account access, you can grant permissions to trusted accounts, allowing them to access and manage specific resources in your account. This helps you facilitate collaboration with partners, vendors, or different teams within your organization.

With cross-account access, you establish a trust relationship between your account and the other trusted accounts. You create an IAM role in your account that defines the permissions you want to grant. Then, you specify the trusted accounts that are allowed to assume the role and then define the actions, resources, and conditions for access.

Once the role is assumed in the trusted account, the user or role in that account receives temporary security credentials with the permissions you defined. These credentials can be used to access resources, such...

Summary

This chapter discussed the different types of access policies used in AWS. These included SCPs, identity-based policies, resource-based policies, and permissions boundaries. You saw some of the granular constructs of creating policies, especially in the case of conditions, and how you can use those constructs to narrow down the scope of the permissions of a policy to the least-privileged access.

You also reviewed how to provide access to a secondary account using roles rather than separate accounts. Using this method can allow you to provide access to third parties who need access to your account for a specific reason and already have their own AWS accounts and IAM users. In addition to using roles, you also learned how using ACLs can enable cross-account access for different types of resources.

In Chapter 15, Federated and Mobile Access, you will examine what federated access is as well as how to allow access to your account from mobile devices using identity providers...

Further Reading

For additional information on the AWS Shared Responsibility Model and the underlying foundation of AWS security, please check out the following resources:

• Introduction to AWS Security: https://packt.link/ZiGxG
• Example IAM identity-based policies: https://packt.link/uv4tF
• IAM JSON policy elements: Condition operators: https://packt.link/QFj56

Exam Readiness Drill – Chapter Review Questions

Apart from a solid understanding of key concepts, being able to think quickly under time pressure is a skill that will help you ace your certification exam. That is why working on these skills early on in your learning journey is key.

Chapter review questions are designed to improve your test-taking skills progressively with each chapter you learn and review your understanding of key concepts in the chapter at the same time. You’ll find these at the end of each chapter.

How To Access These Resources

To learn how to access these resources, head over to the chapter titled Chapter 21, Accessing the Online Practice Resources.

To open the Chapter Review Questions for this chapter, perform the following steps:

1. Click the link – https://packt.link/SCSC02E2_CH14

   Alternatively, you can scan the following QR code (Figure 14.25):

Figure 14.25: QR code that opens Chapter Review...