Articles → AWS → Permission Boundary In AWS

Permission Boundary In AWS

In this article, we will discuss the permission boundary in AWS.

Scenario

Picture showing the issue when permission boundary is not implemented

Click to Enlarge

Consider a scenario, where a user User A is having IAMFullAccess permission. The user User A has created another user User B with the AdministratorAccess permission.

Now, the question is - What can User B do? The answer is - Anything, a user with an AdministratorAccess can do. So, technically User A can do everything that a user with AdministratorAccess permission can do.

To address this issue, the permission boundary comes into the picture.

Steps

To implement the permission boundary, we will work on the following steps: -

Create a user IAMOnlyUser with IAMFullAccess permission
Create a user AdminAccess with AdministratorAccess permission by login using the credentials of IAMOnlyUser user
Launch an EC2 instance using the AdminAccess user
Create a new policy.
Apply permission boundary to IAMOnlyUser user
Delete the AdminAccess user and create a user with AdministratorAccess permission
Launch an EC2 instance with AdminAccess user

Let us start.

Create A User “Iamonlyuser” With “Iamfullaccess” Permission

First,create a user with the IAMFullAccess permission.

Picture showing creating the user Iamonlyuser

Click to Enlarge

Create A User “Adminaccess” With “Administratoraccess” Permission By Login Using The Credentials Of “Iamonlyuser” User

Picture showing creating the user Adminaccess

Click to Enlarge

Launch An EC2 Instance Using The “Adminaccess” User

Try to launch an EC2 instance with the user AdminAccess user.

Picture showing the user Adminaccess having access to EC2 dashboard

Click to Enlarge

As we can confirm from the image above, the user can launch an EC2 instance.

Create A New Policy

Create a new policy with the following JSON.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "IAMAccess",
            "Effect": "Allow",
            "Action": "iam:*",
            "Resource": "*"
        },
        {
            "Sid": "DenyPermBoundaryIAMPolicyAlteration",
            "Effect": "Deny",
            "Action": [
                "iam:DeletePolicy",
                "iam:DeletePolicyVersion",
                "iam:CreatePolicyVersion",
                "iam:SetDefaultPolicyVersion"
            ],
            "Resource": [
                "arn:aws:iam::YourAccount_ID:policy/PermissionsBoundary"
            ]
        },
        {
            "Sid": "DenyRemovalOfPermBoundaryFromAnyUserOrRole",
            "Effect": "Deny",
            "Action": [
                "iam:DeleteUserPermissionsBoundary",
                "iam:DeleteRolePermissionsBoundary"
            ],
            "Resource": [
                "arn:aws:iam::YourAccount_ID:user/*",
                "arn:aws:iam::YourAccount_ID:role/*"
            ],
            "Condition": {
                "StringEquals": {
                    "iam:PermissionsBoundary": "arn:aws:iam::YourAccount_ID:policy/PermissionsBoundary"
                }
            }
        },
        {
            "Sid": "DenyAccessIfRequiredPermBoundaryIsNotBeingApplied",
            "Effect": "Deny",
            "Action": [
                "iam:PutUserPermissionsBoundary",
                "iam:PutRolePermissionsBoundary"
            ],
            "Resource": [
                "arn:aws:iam::YourAccount_ID:user/*",
                "arn:aws:iam::YourAccount_ID:role/*"
            ],
            "Condition": {
                "StringNotEquals": {
                    "iam:PermissionsBoundary": "arn:aws:iam::YourAccount_ID:policy/PermissionsBoundary"
                }
            }
        },
        {
            "Sid": "DenyUserAndRoleCreationWithOutPermBoundary",
            "Effect": "Deny",
            "Action": [
                "iam:CreateUser",
                "iam:CreateRole"
            ],
            "Resource": [
                "arn:aws:iam::YourAccount_ID:user/*",
                "arn:aws:iam::YourAccount_ID:role/*"
            ],
            "Condition": {
                "StringNotEquals": {
                    "iam:PermissionsBoundary": "arn:aws:iam::YourAccount_ID:policy/PermissionsBoundary"
                }
            }
        }
    ]
}

Picture showing creating a new policy for policy boundary

Click to Enlarge

Replace YourAccount_ID with your account number in the above JSON.

Apply Permission Boundary To “Iamonlyuser” User

Apply the permission boundary to the IAMOnlyUser user. For that, go to the Permissions boundary section.

Picture showing the permission boundary section of the user module

Click to Enlarge

Click on the Set boundary button. A window will appear to create a new policy. Select the policy and click on the Set boundary button.

Picture showing adding the permissionboundary policy in the permission boundary of Iamonlyuser user

Click to Enlarge

The permission is added for the user.

Picture showing the permissionboundary policy added as a permission boundary

Click to Enlarge

Delete The “Adminaccess” User And Create A User With “Administratoraccess” Permission

Delete the user AdminAccess and create it again. You will get the following error.

Picture showing the error message when Iamonlyuser user is trying to create AdminAcess user

Click to Enlarge

You cannot create a user unless you add the permission boundary. Once the permission boundary is added, you can create the user.

Picture showing the success message when permission boundary is added to AdminAccess user

Click to Enlarge

Launch An EC2 Instance With “Adminaccess” User

Picture showing the API error message when AdminAccess user is accessing the EC2 dashboard

Click to Enlarge

Posted By -	Karan Gupta

Posted On -	Saturday, May 21, 2022

Query/Feedback

Your Email Id		**

Subject		*

Query/Feedback	Characters remaining 250	**