10.1 Advanced IAM Policies, Roles & Policy Conditions

10.1 Advanced IAM Policies, Roles & Policy Conditions

CloudOps Blueprint Focus: The AWS Certified CloudOps Engineer – Associate (SOA-C03) exam tests your ability to evaluate complex IAM policy logic, implement permissions boundaries to prevent privilege escalation, configure temporary credentials via AWS STS and EKS IRSA, and enforce fine-grained policy conditions including external IDs and Attribute-Based Access Control (ABAC).

IAM Policy Structure & Evaluation Logic

AWS Identity and Access Management (IAM) controls authentication and authorization for every AWS API call by evaluating an authorization request context containing the principal, action, resource, environment attributes, and tags.

An IAM policy document contains statements built from five core elements:

• Effect: Sets the outcome to Allow or Deny.
• Principal: Specifies the entity granted or denied access. Required in resource-based policies and trust policies, but omitted in identity-based policies.
• Action: Lists specific service API calls (e.g., s3:GetObject, ec2:RunInstances).
• Resource: Identifies target resources using Amazon Resource Names (ARNs) or wildcard *.
• Condition: Dictates criteria under which the statement applies using key-value operators.

Evaluation Workflow

1. Default Deny: All requests begin implicitly denied.
2. Explicit Deny Precedence: If any applicable statement contains an explicit Deny, evaluation terminates immediately with a final Deny, overriding all allows.
3. Union of Allows: If no explicit deny exists, at least one statement must explicitly Allow the request. Matching allow statements form a permissive union.
4. Absence of Allow: If no explicit deny and no explicit allow match, the request remains denied.

---

Policy Types: Identity-Based, Resource-Based & Permissions Boundaries

Customer managed policies provide versioning (up to 5 versions), rollback capabilities, and reusability. AWS managed policies are maintained by AWS but often grant broad privileges. Inline policies embed directly into a single entity and should be reserved for strict 1:1 exception mappings.

Resource-based policies attach directly to AWS resources, allowing principals from external accounts to access resources directly without assuming a cross-account role. For AWS KMS, cross-account access requires explicit permission in both the identity policy and the KMS key policy, unless the key policy delegates authority to the external account root.

Permissions Boundaries

A permissions boundary is an IAM managed policy that sets the maximum permissions an identity-based policy can grant. It does not grant permissions on its own; effective permissions are the intersection of the identity policy and the boundary. CloudOps teams use boundaries to safely delegate IAM role creation to developers without risking privilege escalation. Developers are granted iam:CreateRole and iam:PutRolePolicy constrained by a condition requiring that all created roles must have the approved boundary attached.

---

IAM Roles, Temporary Credentials & Advanced Federation

Enterprise operations standardize on IAM Roles that vend short-lived temporary credentials via AWS Security Token Service (STS). Temporary credentials consist of an Access Key ID, Secret Access Key, and Session Token, valid for 15 minutes to 12 hours.

Core STS Operations & EC2 Instance Profiles

• sts:AssumeRole: Exchanges IAM identity or service context for temporary role credentials.
• sts:AssumeRoleWithWebIdentity: Federates OIDC JSON Web Tokens (JWTs) from Kubernetes or GitHub Actions.
• sts:AssumeRoleWithSAML: Exchanges corporate SAML 2.0 assertions for AWS credentials.
• EC2 Instance Profiles: Deliver automatically rotated credentials to EC2 instances via the Instance Metadata Service (IMDSv2) at http://169.254.169.254/latest/meta-data/iam/security-credentials/<role-name>.

Amazon EKS: IAM Roles for Service Accounts (IRSA)

Attaching broad IAM roles to EC2 worker nodes violates least privilege because all pods on the node inherit those permissions. IRSA provides pod-level IAM isolation:

1. An EKS cluster is associated with an IAM OIDC Identity Provider.
2. A Kubernetes ServiceAccount is annotated with eks.amazonaws.com/role-arn.
3. An EKS mutating admission webhook injects AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE into matching pods.
4. The AWS SDK calls sts:AssumeRoleWithWebIdentity using the projected pod token, restricting permissions strictly to that microservice.

Cross-Account Role Assumption & Confused Deputy Mitigation

When third-party SaaS vendors manage AWS infrastructure across multiple clients, a malicious client could trick the SaaS vendor into accessing another customer's resources (the confused deputy problem). To eliminate this risk, the customer's role trust policy must require the sts:ExternalId condition key. The vendor assigns a unique External ID string per customer, ensuring the vendor supplies the correct client token during sts:AssumeRole.

---

Advanced Policy Condition Keys & ABAC

Advanced condition keys enforce contextual guardrails:

• aws:PrincipalOrgID: Verifies that the calling principal belongs to a specific AWS Organization (e.g., o-1234567890), simplifying multi-account S3 bucket policies.
• aws:SourceIp: Restricts API execution to corporate IP CIDRs. Caveat: When an AWS service acts on a user's behalf (such as CloudFormation provisioning resources), service calls fail unless combined with aws:ViaAWSService or service principal exemptions.
• aws:SecureTransport: Enforces TLS by explicitly denying actions when {"Bool": {"aws:SecureTransport": "false"}}.
• aws:RequestedRegion: Geo-fences API requests to approved AWS Regions.
• aws:MultiFactorAuthPresent: Mandates active MFA for destructive actions like terminating EC2 instances or deleting snapshots.
• Attribute-Based Access Control (ABAC): Compares tags on the principal (aws:PrincipalTag/Department) with tags on the resource (aws:ResourceTag/Department). ABAC scales authorization dynamically without requiring continuous policy edits as new employees or resources are provisioned.