AWS Identity for CloudOps - IAM, Federation and Access Reviews

IAM Core Model#

IAM controls who can do what to which AWS resources.

Principal
  -> Action
    -> Resource
      -> Conditions

Policy evaluation rules to remember:

1. Default is deny.
2. Explicit allow grants access.
3. Explicit deny overrides any allow.
4. SCPs and permission boundaries set ceilings; they do not grant access by themselves.

Users, Groups, and Roles#

STS and AssumeRole#

Security Token Service returns temporary credentials when a principal assumes a role.

Common uses:

• EC2 instance role calling AWS APIs.
• Lambda execution role.
• Cross-account admin role.
• Federated user assuming a role through SAML or OIDC.

Federation and IAM Identity Center#

IAM Identity Center centralizes workforce access across multiple AWS accounts in an Organization. It connects to external identity providers and assigns permission sets to users or groups.

Permission Boundaries#

A permission boundary limits the maximum permissions a role or user can receive.

Use boundaries when teams can create roles but should not create unlimited administrators.

IAM policy allows ec2:* and iam:*
Permission boundary allows ec2:* only
Effective permissions: ec2:* only

Hands-on: Create an EC2 Role for S3 Read Access#

Goal: Let an EC2 instance read one S3 bucket without storing access keys.

1. Create an IAM policy allowing s3:ListBucket on the bucket and s3:GetObject on objects in the bucket.
2. Create an IAM role with trusted entity AWS service and use case EC2.
3. Attach the S3 read policy.
4. Attach the role to an EC2 instance with Actions > Security > Modify IAM role.
5. Connect to the instance.
6. Test access:

aws s3 ls s3://my-cloudops-bucket
aws s3 cp s3://my-cloudops-bucket/test.txt /tmp/test.txt

7. Confirm there are no static access keys on the instance.

Hands-on: Generate and Review IAM Credential Report#

1. Open IAM > Credential report.
2. Generate the report.
3. Download the CSV.
4. Review users without MFA, active access keys older than 90 days, unused console passwords, and root account access keys.
5. Create remediation tasks to enable MFA, rotate or delete old keys, and remove unused users.

Hands-on: Find External Access with IAM Access Analyzer#

1. Open IAM Access Analyzer.
2. Create an account or organization analyzer.
3. Review findings for public S3 buckets, cross-account KMS keys, and SQS/SNS policies shared externally.
4. Archive expected findings with a reason.
5. Fix unexpected findings by tightening the resource policy.

Common SOA-C03 Exam Questions#

Q: What overrides every allow? An explicit deny.

Q: How should EC2 call S3 securely? Attach an IAM role to the instance. Do not store access keys on disk.

Q: What service is best for workforce SSO across many AWS accounts? IAM Identity Center.

What to Learn Next#

1. AWS Account Management - SCPs and Organizations
2. AWS Security & Compliance - Access Analyzer, GuardDuty, Security Hub
3. AWS Systems Manager - role requirements for managed nodes