IAM policy evaluation: explicit deny, SCPs and boundaries

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

1. An application in a member account of an organization must write to an Amazon DynamoDB table in the same account. The IAM role it uses has an identity-based policy that allows dynamodb:PutItem on the table, and the table has no resource-based policy. The writes are denied. A service control policy on the account's organizational unit denies dynamodb:PutItem. Which approach will meet these requirements?

   Right. In the game that’s Renown for your Design Secure Architectures building.

   Not that one: C is right. In the game your Design Secure Architectures building would lose a little Renown, and this question would come back later.

   Your answerA.Attach a resource-based policy to the DynamoDB table that allows the role to call dynamodb:PutItem on that table.A resource-based allow is evaluated after the deny step as well, and the request never reaches it.Your answerB.Attach a permissions boundary to the role that allows dynamodb:PutItem, so that the boundary and the identity-based policy intersect on the action.A boundary can only remove permissions. It never restores one that an explicit deny has taken away.The answerC.Remove the Deny statement for dynamodb:PutItem from the service control policy, or scope it with a condition that excludes this role.An explicit deny is not outvoted, so the deny itself has to go.Your answerD.Add an Allow statement for dynamodb:PutItem to the service control policy, so that the action is allowed by the SCP as well as by the role.Allowing an action that is also explicitly denied changes nothing. Deny evaluation runs before the SCP allow check, and an explicit deny ends the evaluation.

   Show the full explanation and doc quotes

   Policy evaluation begins with the deny step: the enforcement code "evaluates all policies within the account that apply to the request", including SCPs, resource-based policies, identity-based policies, boundaries and session policies, and "if the enforcement code finds even one explicit deny that applies, the enforcement code returns a final decision of Deny". Everything the other options add is evaluated after that step. It is true that an SCP must also contain an applicable Allow - "If the enforcement code does not find any applicable Allow statements in the SCPs, the enforcement code returns a final decision of Deny" - and that is what makes A the tempting repair, but an Allow beside a Deny for the same action leaves the Deny in force. Removing it, or narrowing it with a condition so that it no longer matches this role, is the only change that reaches the request.

   Written from docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic_policy-eval-denyallow.html

2. Developers create IAM roles for AWS Lambda functions in a member account of an organization. No principal in the account, including the root user, may use any service outside an approved list. The roles that developers create must never be able to use more than Amazon S3 and Amazon DynamoDB, even if a developer attaches a broader policy to a role. Which combination of steps should a solutions architect take to meet these requirements? (Select TWO.)

   Right. In the game that’s Renown for your Design Secure Architectures building.

   Not that one: D,E is right. In the game your Design Secure Architectures building would lose a little Renown, and this question would come back later.

   Your answerA.Attach a session policy that allows only Amazon S3 and Amazon DynamoDB to each of the roles that the developers create for their functions.Misplaces a session policy. It is passed as a parameter when a session is created programmatically, not attached to a role as a standing limit.Your answerB.Attach an identity-based policy to the account's root user that denies every service outside the approved list.Targets a principal that cannot be given policies. The root user's permissions cannot be changed with IAM policies; an SCP is the control that reaches it.Your answerC.Add a bucket policy to each S3 bucket that allows only the developers' roles.Guards only the buckets. A bucket policy says nothing about the other services a role might call, such as Amazon EC2.Your answerD.Attach a service control policy to the account's OU that allows only the services on the approved list.Your answerE.Require a permissions boundary that allows only Amazon S3 and Amazon DynamoDB on every role that developers create.

   Show the full explanation and doc quotes

   (https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html). A permissions boundary caps a role whatever its policies grant: "An entity's permissions boundary allows it to perform only the actions that are allowed by both its identity-based policies and its permissions boundaries." With both in place, "the request is allowed only if all three policy types allow it", so a broader policy attached by a developer cannot lift a role past Amazon S3 and Amazon DynamoDB.

   Written from docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html

3. An IAM user in a company's account has a permissions boundary that allows only Amazon S3 and Amazon CloudWatch actions. The security team will not change the boundary. The user must be able to read one AWS Secrets Manager secret in the same account. Which solution meets these requirements?

   Right. In the game that’s Renown for your Design Secure Architectures building.

   Not that one: C is right. In the game your Design Secure Architectures building would lose a little Renown, and this question would come back later.

   Your answerA.Add the IAM user to an IAM group whose policy allows secretsmanager:GetSecretValue on the secret.Runs into the boundary. A group policy is an identity-based policy, and effective permissions are its intersection with the boundary, which omits Secrets Manager.Your answerB.Attach a resource-based policy to the secret that allows the IAM user's ARN, and have the user read it with GetFederationToken credentials.Steps outside the exception. A grant to the ARN of the IAM user who federated is limited by the boundary during the federated session.The answerC.Attach a resource-based policy to the secret that allows the IAM user's ARN to call secretsmanager:GetSecretValue.A same-account resource-based policy that names the user is not capped by the boundary's silence. "Within the same account, resource-based policies that grant permissions to an IAM user ARN (that is not an AWS STS federated user principal session) are not limited by an implicit deny in an identity-based policy or permissions boundary." The page works this case: when a policy on a secret "allows Nikhil to perform the secretsmanager:GetSecretValue action, then Nikhil can retrieve and decrypt the secret", because "implicit denies in permissions boundaries do not limit resource-based policies."Your answerD.Attach a resource-based policy to the secret that allows the ARN of an IAM role with the same boundary, and let the user assume that role.Grants the role ARN instead of the user's. A resource-based policy granting a role ARN is limited by an implicit deny in the role's permissions boundary.

   Written from docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html